Microsoft 365 Administrator Expert Managing Defender for Office Flashcards
7 cards from real MS-102 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Microsoft 365 Administrator Expert Managing Defender for Office flashcards as text
An administrator notices that Safe Links is not rewriting URLs in emails sent between internal users. What is the most likely cause?
Answer: Safe Links does not support internal email scanning by default and requires enabling 'Apply Safe Links to email sent within the organization'
Safe Links must be explicitly configured to scan internal email by enabling the 'Apply Safe Links to email sent within the organization' setting in the policy.
Which Defender for Office 365 feature provides a detonation-based analysis of email attachments in an isolated environment before delivery?
Answer: Safe Attachments
Safe Attachments detonates suspicious attachments in a sandboxed virtual environment to detect malware before the email is delivered to the recipient.
A user reports that clicking a URL in an Outlook desktop client is not being checked by Safe Links. Which setting must be enabled in the Safe Links policy?
Answer: Apply Safe Links to supported Office apps
The 'Apply Safe Links to supported Office apps' setting must be enabled to protect URLs clicked within Office desktop applications like Word, Excel, and Outlook.
Which report in the Microsoft Defender portal shows the volume of messages identified as malware, phish, spam, and bulk over time?
Answer: Mail flow status summary report
The Mail flow status summary report displays aggregated counts of messages categorized as malware, phish, spam, and bulk for a selected time range.
An organization wants to ensure that emails failing SPF, DKIM, or DMARC checks are automatically moved to quarantine. Which policy controls this behavior?
Answer: Anti-phishing policy with spoof intelligence settings
The anti-phishing policy's spoof intelligence settings control how messages that fail composite authentication (SPF/DKIM/DMARC) are handled, including moving them to quarantine.
What is the purpose of the 'Restricted entities' page in the Microsoft Defender portal?
Answer: It shows user accounts blocked from sending email due to sending suspicious or high-volume messages
The Restricted entities page shows user accounts that have been blocked from sending email after being flagged for suspicious outbound sending behavior.
Which Defender for Office 365 capability allows an administrator to submit a false-positive quarantined message directly to Microsoft for analysis?
Answer: Admin submission via the Submissions page
The Submissions page in the Microsoft Defender portal allows admins to submit quarantined messages, URLs, or email attachments to Microsoft as false positives or false negatives for analysis.