SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Anti-malware policy

  Why it's wrong here

  An anti-malware policy primarily focuses on detecting and blocking malicious software like viruses, worms, and Trojans embedded in emails or attachments. While crucial for overall email security, it does not specifically address the techniques used in phishing, such as sender impersonation or domain spoofing, which rely on tricking users rather than delivering executable malware directly. Therefore, it's insufficient on its own to protect against phishing attacks.

• ✗

  Safe Links policy

  Why it's wrong here

  A Safe Links policy is designed to protect users from malicious URLs by rewriting and scanning them at the time of click. It checks if a link leads to a known phishing site or malware host, preventing access even if the original email passed initial scans. However, Safe Links does not verify the authenticity of the email sender or the domain itself, meaning it won't prevent a spoofed email from reaching the inbox if the embedded links are initially benign or lead to credential harvesting sites not yet identified as malicious.

• ✓

  Anti-phishing policy with SPF/DKIM/DMARC settings

  Why this is correct

  An anti-phishing policy, especially when configured with SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance) settings, is specifically designed to combat phishing attacks. These authentication mechanisms verify the sender's identity and domain legitimacy, preventing spoofed emails and impersonation attempts from reaching recipients. This comprehensive approach directly addresses the core techniques used in phishing by ensuring email authenticity and enforcing policies on unauthenticated messages.

• ✗

  Safe Attachments policy

  Why it's wrong here

  A Safe Attachments policy provides advanced threat protection by opening email attachments in a virtual detonation chamber to analyze their behavior before delivery. This process identifies and neutralizes zero-day malware or other malicious content hidden within files. While vital for preventing malware delivery, Safe Attachments does not inspect the email's header for sender authentication or identify spoofed domains, making it ineffective against phishing attacks that primarily rely on social engineering and credential harvesting without necessarily including malicious file attachments.

Go deeper

Related to this question