SkillTestPro | SC-900 Practice Test 23 Hard Questions

SC-900 Exam Practice Test 23 (Hard) - Microsoft Defender for Office 365 Deep-Dive

SC-900 Exam Practice Tests

1 / 15

Which Microsoft Defender for Office 365 feature rewrites URLs in emails and checks them for malicious content at the time the recipient clicks the link, not just when the email is delivered?

Safe Attachments

Anti-phishing policies

Safe Links

Anti-spam policies

Zero-hour auto purge (ZAP)

Threat Explorer

2 / 15

Which Microsoft Defender for Office 365 feature opens email attachments in an isolated, virtual sandbox environment to detonate and analyze them for malicious behavior before delivery?

Safe Links

Anti-phishing policies

Safe Attachments

Anti-spam policies

Zero-hour auto purge (ZAP)

Threat Explorer

3 / 15

Which Microsoft Defender for Office 365 feature uses machine learning and impersonation detection to identify and block emails attempting to impersonate a trusted executive or domain?

Safe Links

Safe Attachments

Anti-phishing policies

Anti-spam policies

Zero-hour auto purge (ZAP)

Threat Explorer

4 / 15

Which Microsoft Defender for Office 365 feature can retroactively remove an email from user inboxes after it has already been delivered, once it is subsequently determined to be malicious?

Safe Links, which protects against malicious URLs at click-time rather than retroactively removing delivered emails

Safe Attachments, which scans attachments before delivery rather than retroactively removing delivered emails

Zero-hour auto purge (ZAP)

Anti-spam policies alone, which filter incoming spam rather than retroactively removing already-delivered emails

Anti-phishing policies alone, which block phishing at delivery time rather than retroactively removing already-delivered emails

Threat Explorer alone, which is an investigation tool rather than an automated retroactive removal mechanism

5 / 15

Which Microsoft Defender for Office 365 feature provides a centralized tool for security teams to investigate and analyze email-based threats across the organization, such as identifying all recipients of a malicious campaign?

Safe Links alone

Safe Attachments alone

Threat Explorer (Explorer)

Anti-phishing policies alone

Anti-spam policies alone

Zero-hour auto purge alone

6 / 15

Which Microsoft Defender for Office 365 feature allows an organization to simulate realistic phishing attacks against their own employees to assess and improve security awareness?

Safe Links alone

Safe Attachments alone

Attack simulation training

Anti-phishing policies alone

Zero-hour auto purge alone

Threat Explorer alone

7 / 15

Which Microsoft Defender for Office 365 plan tier includes Safe Links, Safe Attachments, and anti-phishing capabilities?

A basic Exchange Online Protection (EOP) license alone, which provides only baseline anti-spam and anti-malware filtering without these advanced capabilities

A Microsoft Entra ID Free license alone

Microsoft Defender for Office 365 Plan 1

A standalone Microsoft Defender for Endpoint license alone

A standalone Microsoft Defender for Identity license alone

A trial-only license with no ongoing feature entitlement

8 / 15

Which Microsoft Defender for Office 365 plan tier adds capabilities such as Threat Explorer, automated investigation and response (AIR), and attack simulation training, beyond Plan 1?

Plan 1, which provides more foundational protective capabilities without these additional investigative and simulation tools

Exchange Online Protection alone

Microsoft Defender for Office 365 Plan 2

A standalone Microsoft Defender for Endpoint license alone

A standalone Microsoft Defender for Identity license alone

A trial-only license with no ongoing feature entitlement

9 / 15

Which baseline Microsoft 365 service provides fundamental anti-spam, anti-malware, and basic anti-phishing filtering for email, even without an additional Defender for Office 365 license?

Safe Links, which requires an additional Defender for Office 365 license

Safe Attachments, which requires an additional Defender for Office 365 license

Exchange Online Protection (EOP)

Threat Explorer, which requires an additional Defender for Office 365 Plan 2 license

Attack simulation training, which requires an additional Defender for Office 365 Plan 2 license

Automated investigation and response, which requires an additional Defender for Office 365 Plan 2 license

10 / 15

Which Microsoft Defender for Office 365 automated investigation and response (AIR) capability automatically triggers a playbook-style investigation when a suspicious email or user-reported message is flagged?

Safe Links alone, which focuses on click-time URL protection rather than automated post-detection investigation

Safe Attachments alone, which focuses on pre-delivery scanning rather than automated post-detection investigation

Automated investigation and response (AIR) for email

Anti-spam policies alone

Zero-hour auto purge alone, which retroactively removes email rather than orchestrating a broader automated investigation

Threat Explorer alone, which is a manual investigation tool rather than an automated triggering mechanism

11 / 15

Which Microsoft Defender for Office 365 capability allows end users to easily flag a suspicious email they received, feeding that report into the security team's investigation and response workflow?

Safe Links alone, which operates transparently without requiring explicit end-user reporting

Safe Attachments alone, which operates transparently without requiring explicit end-user reporting

The Report Message / Report Phishing add-in

Anti-spam policies alone, which operate at the mail flow level rather than through explicit end-user reporting

Threat Explorer alone, which is a security team investigation tool rather than an end-user reporting mechanism

Zero-hour auto purge alone, which is an automated backend mechanism rather than an end-user reporting tool

12 / 15

Which type of impersonation protection specifically focuses on detecting emails attempting to impersonate a specific, designated high-value individual, such as a CEO?

Domain impersonation protection, which focuses on impersonated domains rather than a specific named individual

Anti-spam bulk email filtering, which focuses on unsolicited bulk mail rather than targeted impersonation of an individual

User impersonation protection

Safe Links click-time protection, which focuses on malicious URLs rather than sender impersonation

Safe Attachments sandboxing, which focuses on malicious file content rather than sender impersonation

Zero-hour auto purge, which retroactively removes already-delivered malicious mail rather than specifically detecting individual impersonation

13 / 15

Which type of impersonation protection specifically focuses on detecting emails attempting to impersonate a trusted organizational domain, rather than a specific named individual?

User impersonation protection, which focuses on a specific named individual rather than a broader domain

Anti-spam bulk email filtering

Domain impersonation protection

Safe Links click-time protection

Safe Attachments sandboxing

Zero-hour auto purge

14 / 15

Which term describes the overall approach of Microsoft Defender for Office 365 to protect against threats delivered through email and collaboration tools before, during, and after delivery?

A single, one-time scan performed only at the moment of initial delivery with no other protective stage

A purely reactive approach with no pre-delivery scanning of any kind

A layered, multi-stage protection approach (pre-delivery, at time-of-click, and post-delivery)

A purely manual approach requiring an analyst to review every single email individually

An approach limited exclusively to attachment scanning, with no URL or impersonation protection

An approach that provides no protection whatsoever after an email has already been delivered

15 / 15

Which term describes a targeted, sophisticated phishing attack that impersonates a trusted executive to trick an employee into making a fraudulent wire transfer or divulging sensitive information?

A generic, untargeted spam email

A denial-of-service attack

Business email compromise (BEC)

A brute-force password attack

A generic malware infection with no impersonation or targeting involved

A physical social engineering attack conducted in person rather than via email

Your score is

The average score is 0%