SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your organization uses Microsoft Defender XDR (formerly Microsoft 365 Defender). A user reports receiving a suspicious email with a link. The email was not blocked by Exchange Online Protection (EOP). Which feature should you use to investigate the link's reputation in real time?
⚠ Common exam trap
It's easy for candidates to confuse Safe Links with Safe Attachments, thinking both handle links, but Safe Attachments only scans file attachments, not URLs embedded in email bodies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Safe Links policy
Safe Links is the correct feature because it provides real-time URL reputation checking at the time of click. When a user clicks a link in an email, Safe Links checks the link against Microsoft's threat intelligence to determine if it is malicious, even if the email itself was not blocked by EOP. This allows investigation of the suspicious link's reputation after delivery.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Exchange Online Protection (EOP) filtering
Why it's wrong here
Exchange Online Protection (EOP) provides foundational protection against spam, malware, and known threats at the perimeter of an organization's email infrastructure. While EOP performs initial URL reputation checks, it primarily focuses on broad threat categories and may not detect sophisticated, newly created, or polymorphic malicious URLs that require real-time detonation or advanced heuristics, necessitating additional layers like Safe Links for comprehensive protection.
- ✗
Anti-phish policy
Why it's wrong here
Anti-phish policies in Microsoft Defender for Office 365 are specifically designed to protect against impersonation, spoofing, and domain lookalike attacks by analyzing sender, domain, and message content characteristics. While crucial for identifying and mitigating phishing attempts, these policies do not actively rewrite or scan URLs at the time of click for real-time reputation, which is a distinct and separate function provided by Safe Links.
- ✗
Safe Attachments policy
Why it's wrong here
Safe Attachments policies protect against zero-day malware in email attachments by detonating files in a virtual environment to analyze their behavior before delivery to the recipient's inbox. This advanced protection is specifically for file-based threats and does not extend to scanning or rewriting URLs embedded within the email body or within documents themselves, which requires a different mechanism for real-time link protection.
- ✓
Safe Links policy
Why this is correct
Safe Links policies provide real-time, click-time protection by dynamically rewriting URLs in emails and supported Office documents. When a user clicks a rewritten link, it is scanned against continuously updated reputation lists and, if necessary, detonated in a sandbox, blocking access to malicious sites. This ensures dynamic protection against evolving web-based threats and provides detailed reporting for security teams.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
XDR
XDR, or Extended Detection and Response, is a unified security platform that collects and correlates data across multiple security layers—endpoints, networks, servers, cloud workloads, and email—to improve threat detection and enable faster response.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.