MS-203 - Microsoft 365 Messaging Message Hygiene and Protection Questions and Answers — Questions and Answers
Question 1: Your organization is concerned about malicious attachments in emails. You want to implement a solution where attachments are analyzed in a sandbox environment, but users receive the email body immediately to avoid workflow delays. A placeholder attachment should indicate that the original is being scanned. Which Microsoft Defender for Office 365 Safe Attachments policy action should you configure?
- Block
- Replace
- Monitor
- Dynamic Delivery (Correct answer)
Correct answer: Dynamic Delivery
The 'Dynamic Delivery' action in a Safe Attachments policy delivers the email message to the recipient without the attachments. A placeholder attachment is added, explaining that the original attachments are being scanned. If the attachments are found to be safe, they are reattached to the original message in the user's mailbox. This approach minimizes email delays while still providing robust protection.
Question 2: An administrator has successfully implemented SPF and DKIM. To complete the email authentication setup, they need to create a DMARC record. Which DMARC policy tag (`p=`) should be used to instruct receiving email servers to move messages that fail DMARC checks to the recipient's junk or spam folder?
- p=reject
- p=none
- p=quarantine (Correct answer)
- p=monitor
Correct answer: p=quarantine
The DMARC policy tag `p=quarantine` instructs the receiving server to accept the message but place it in a location other than the inbox, such as the spam or junk folder. `p=none` is for monitoring only, and `p=reject` instructs the server to block the message entirely.
Question 3: A messaging administrator is configuring an anti-phishing policy in Microsoft Defender for Office 365 to protect senior executives from spear-phishing and whaling attacks. Which specific feature allows the administrator to define a list of high-profile users to protect from attacks where the sender's display name and address mimic the user?
- Spoof intelligence
- Mailbox intelligence
- Impersonation protection (Correct answer)
- First contact safety tip
Correct answer: Impersonation protection
Impersonation protection, a feature within Defender for Office 365 anti-phishing policies, is designed to combat spear-phishing and whaling. It allows administrators to explicitly define a list of 'protected users' (like executives) and 'protected domains' to detect and act on messages where attackers try to impersonate these specific entities.
Question 4: An organization wants to give users the ability to release messages quarantined as 'Spam' but prevent them from releasing messages quarantined as 'High-confidence phish'. Users should only be able to request the release of high-confidence phish messages for an administrator to review. Where must this granular control be configured?
- In the Anti-spam policy actions
- In a mail flow rule
- In a Quarantine policy (Correct answer)
- In the Tenant Allow/Block List
Correct answer: In a Quarantine policy
Quarantine policies define what actions users can take on their own quarantined messages, based on the reason the message was quarantined (e.g., spam, bulk, phish, malware). An administrator can create custom quarantine policies to grant different permission levels, such as allowing release for spam but only allowing 'request release' for high-confidence phish.
Question 5: An email message containing a previously unknown malware variant was delivered to several users' inboxes because it was not detected by the initial real-time scans. A few hours later, Microsoft's threat intelligence services are updated with a signature for this new threat. Which Exchange Online Protection feature retroactively removes the malicious message from the user inboxes?
- Safe Links time-of-click verification
- Zero-hour auto purge (ZAP) (Correct answer)
- Dynamic Delivery
- Connection filtering
Correct answer: Zero-hour auto purge (ZAP)
Zero-hour auto purge (ZAP) is an Exchange Online Protection feature that detects and neutralizes malicious spam, phishing, and malware messages that have already been delivered to mailboxes. If a post-delivery scan determines a message is malicious, ZAP will move it to the junk folder or quarantine.
Question 6: A user clicks a link in an email that has been processed by a Microsoft Defender Safe Links policy. The URL in the browser's address bar starts with `https://nam01.safelinks.protection.outlook.com`. What is the primary function of this URL rewriting?
- To add the original website to the user's trusted sites list.
- To check the destination URL against a blocklist and scan its content for threats at the time of the click. (Correct answer)
- To translate the website content into the user's default language.
- To ensure the link can only be clicked once by the recipient.
Correct answer: To check the destination URL against a blocklist and scan its content for threats at the time of the click.
Safe Links rewrites URLs in inbound emails. When a user clicks the rewritten link, Microsoft Defender for Office 365 checks the original destination against a dynamic list of malicious sites. It also performs a real-time scan of the destination content for suspicious behavior. This 'time-of-click' verification protects users from links that appear safe on delivery but are later weaponized.
MS-203 - Microsoft 365 Messaging Message Hygiene and Protection Questions and Answers
Your organization is concerned about malicious attachments in emails.
You want to implement a solution where attachments are analyzed in a sandbox environment, but users receive the email body immediately to avoid workflow delays.
A placeholder attachment should indicate that the original is being scanned.
Which Microsoft Defender for Office 365 Safe Attachments policy action should you configure?