SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your organization wants to ensure that all external emails are automatically tagged with a disclaimer at the top of the email body. Which Microsoft Exchange Online feature should you configure?
⚠ Common exam trap
Many candidates confuse mail flow rules with DLP policies because both can apply conditions and actions to emails, but DLP policies cannot modify the email body with a disclaimer—they only detect and protect data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mail flow rule (transport rule)
Mail flow rules (also known as transport rules) in Exchange Online allow you to inspect messages and take actions such as adding a disclaimer to the top of the email body. This rule can be scoped to apply only to external emails by using the condition 'The sender is located outside the organization'. The action 'Prepend a disclaimer' inserts the text at the beginning of the message body, meeting the requirement precisely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Journal rule
Why it's wrong here
Journal rules are designed for regulatory compliance and eDiscovery, creating an immutable copy of all specified messages (inbound, outbound, or internal) and storing them in a journal mailbox. While crucial for data retention and legal hold requirements, journal rules do not modify message content or add elements like disclaimers before delivery to recipients. Their sole purpose is to capture an unaltered record of communication for auditing.
- ✗
Data loss prevention (DLP) policy
Why it's wrong here
Data Loss Prevention (DLP) policies are specifically engineered to identify, monitor, and protect sensitive information from being accidentally or intentionally shared outside the organization. These policies use sensitive information types and rules to detect data like credit card numbers or health records, then block, encrypt, or alert on such transmissions. DLP's primary function is data protection and leakage prevention, not the modification of message content to include standard disclaimers.
- ✗
Safe Links policy
Why it's wrong here
Safe Links policies, part of Microsoft Defender for Office 365, provide time-of-click verification of URLs in emails and Office documents. When a user clicks a link, Safe Links scans it in real-time to determine if it's malicious, rewriting the URL to redirect through a secure proxy if necessary. This security feature is solely focused on preventing users from accessing harmful websites and does not possess any functionality to append text or disclaimers to email messages.
- ✓
Mail flow rule (transport rule)
Why this is correct
Mail flow rules, also known as transport rules in Exchange Online, are powerful tools that allow administrators to inspect, modify, or route email messages based on specific conditions. These rules operate at the transport layer, enabling actions such as adding disclaimers, blocking messages, encrypting content, or redirecting mail before it reaches the recipient's inbox. Applying a standardized disclaimer to all external emails is a classic and direct application of a mail flow rule's capabilities.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Exchange Online
Exchange Online is Microsoft's cloud-based email, calendar, and contact hosting service that is part of the Microsoft 365 suite, allowing organizations to manage corporate messaging without maintaining their own mail servers.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.