MS-203 - Microsoft 365 Messaging Message Hygiene and Protection Questions and Answers

Question 1

Your organization is concerned about malicious attachments in emails. You want to implement a solution where attachments are analyzed in a sandbox environment, but users receive the email body immediately to avoid workflow delays. A placeholder attachment should indicate that the original is being scanned. Which Microsoft Defender for Office 365 Safe Attachments policy action should you configure?

Accepted Answer

Dynamic Delivery

Answer

The 'Dynamic Delivery' action in a Safe Attachments policy delivers the email message to the recipient without the attachments. A placeholder attachment is added, explaining that the original attachments are being scanned. If the attachments are found to be safe, they are reattached to the original message in the user's mailbox. This approach minimizes email delays while still providing robust protection.

Question 2

An administrator has successfully implemented SPF and DKIM. To complete the email authentication setup, they need to create a DMARC record. Which DMARC policy tag (`p=`) should be used to instruct receiving email servers to move messages that fail DMARC checks to the recipient's junk or spam folder?

Accepted Answer

p=quarantine

Answer

The DMARC policy tag `p=quarantine` instructs the receiving server to accept the message but place it in a location other than the inbox, such as the spam or junk folder. `p=none` is for monitoring only, and `p=reject` instructs the server to block the message entirely.

Question 3

A messaging administrator is configuring an anti-phishing policy in Microsoft Defender for Office 365 to protect senior executives from spear-phishing and whaling attacks. Which specific feature allows the administrator to define a list of high-profile users to protect from attacks where the sender's display name and address mimic the user?

Accepted Answer

Impersonation protection

Answer

Impersonation protection, a feature within Defender for Office 365 anti-phishing policies, is designed to combat spear-phishing and whaling. It allows administrators to explicitly define a list of 'protected users' (like executives) and 'protected domains' to detect and act on messages where attackers try to impersonate these specific entities.

Question 4

An organization wants to give users the ability to release messages quarantined as 'Spam' but prevent them from releasing messages quarantined as 'High-confidence phish'. Users should only be able to request the release of high-confidence phish messages for an administrator to review. Where must this granular control be configured?

Accepted Answer

In a Quarantine policy

Answer

Quarantine policies define what actions users can take on their own quarantined messages, based on the reason the message was quarantined (e.g., spam, bulk, phish, malware). An administrator can create custom quarantine policies to grant different permission levels, such as allowing release for spam but only allowing 'request release' for high-confidence phish.

Question 5

An email message containing a previously unknown malware variant was delivered to several users' inboxes because it was not detected by the initial real-time scans. A few hours later, Microsoft's threat intelligence services are updated with a signature for this new threat. Which Exchange Online Protection feature retroactively removes the malicious message from the user inboxes?

Accepted Answer

Zero-hour auto purge (ZAP)

Answer

Zero-hour auto purge (ZAP) is an Exchange Online Protection feature that detects and neutralizes malicious spam, phishing, and malware messages that have already been delivered to mailboxes. If a post-delivery scan determines a message is malicious, ZAP will move it to the junk folder or quarantine.

Microsoft 365 Messaging (MS-203) Practice Test

Microsoft 365 Messaging (MS-203) Practice Test

MS-203 - Microsoft 365 Messaging Message Hygiene and Protection Questions and Answers