Message Hygiene and Protection Flashcards

Your organization is concerned about malicious attachments in emails. You want to implement a solution where attachments are analyzed in a sandbox environment, but users receive the email body immediately to avoid workflow delays. A placeholder attachment should indicate that the original is being scanned. Which Microsoft Defender for Office 365 Safe Attachments policy action should you configure?

Answer: Dynamic Delivery

The 'Dynamic Delivery' action in a Safe Attachments policy delivers the email message to the recipient without the attachments. A placeholder attachment is added, explaining that the original attachments are being scanned. If the attachments are found to be safe, they are reattached to the original message in the user's mailbox. This approach minimizes email delays while still providing robust protection.

An administrator has successfully implemented SPF and DKIM. To complete the email authentication setup, they need to create a DMARC record. Which DMARC policy tag (`p=`) should be used to instruct receiving email servers to move messages that fail DMARC checks to the recipient's junk or spam folder?

Answer: p=quarantine

The DMARC policy tag `p=quarantine` instructs the receiving server to accept the message but place it in a location other than the inbox, such as the spam or junk folder. `p=none` is for monitoring only, and `p=reject` instructs the server to block the message entirely.

A messaging administrator is configuring an anti-phishing policy in Microsoft Defender for Office 365 to protect senior executives from spear-phishing and whaling attacks. Which specific feature allows the administrator to define a list of high-profile users to protect from attacks where the sender's display name and address mimic the user?

Answer: Impersonation protection

Impersonation protection, a feature within Defender for Office 365 anti-phishing policies, is designed to combat spear-phishing and whaling. It allows administrators to explicitly define a list of 'protected users' (like executives) and 'protected domains' to detect and act on messages where attackers try to impersonate these specific entities.

An organization wants to give users the ability to release messages quarantined as 'Spam' but prevent them from releasing messages quarantined as 'High-confidence phish'. Users should only be able to request the release of high-confidence phish messages for an administrator to review. Where must this granular control be configured?

Answer: In a Quarantine policy

Quarantine policies define what actions users can take on their own quarantined messages, based on the reason the message was quarantined (e.g., spam, bulk, phish, malware). An administrator can create custom quarantine policies to grant different permission levels, such as allowing release for spam but only allowing 'request release' for high-confidence phish.

An email message containing a previously unknown malware variant was delivered to several users' inboxes because it was not detected by the initial real-time scans. A few hours later, Microsoft's threat intelligence services are updated with a signature for this new threat. Which Exchange Online Protection feature retroactively removes the malicious message from the user inboxes?

Answer: Zero-hour auto purge (ZAP)

Zero-hour auto purge (ZAP) is an Exchange Online Protection feature that detects and neutralizes malicious spam, phishing, and malware messages that have already been delivered to mailboxes. If a post-delivery scan determines a message is malicious, ZAP will move it to the junk folder or quarantine.

A user clicks a link in an email that has been processed by a Microsoft Defender Safe Links policy. The URL in the browser's address bar starts with `https://nam01.safelinks.protection.outlook.com`. What is the primary function of this URL rewriting?

Answer: To check the destination URL against a blocklist and scan its content for threats at the time of the click.

Safe Links rewrites URLs in inbound emails. When a user clicks the rewritten link, Microsoft Defender for Office 365 checks the original destination against a dynamic list of malicious sites. It also performs a real-time scan of the destination content for suspicious behavior. This 'time-of-click' verification protects users from links that appear safe on delivery but are later weaponized.