Threat Protection & Security Operations Flashcards

Which Microsoft 365 anti-spam feature uses machine learning to detect and quarantine bulk commercial email?

Answer: Spam confidence level (SCL) filtering

Exchange Online Protection uses spam confidence levels (SCL) based on machine learning to classify and filter bulk and spam email messages.

An organization wants to protect against CEO fraud / business email compromise. Which Defender for Office 365 feature should be enabled?

Answer: Anti-phishing impersonation protection

Anti-phishing impersonation protection detects emails that attempt to impersonate specific users or domains, which is the mechanism behind BEC and CEO fraud.

Which Exchange Online Protection action delivers a message to the recipient's Junk Email folder based on spam verdict?

Answer: Move message to Junk Email folder

The 'Move to Junk Email folder' action is the default action for messages that meet the spam threshold in Exchange Online Protection anti-spam policies.

What is the purpose of DMARC in email security for Microsoft 365?

Answer: Allows domain owners to specify how unauthenticated email should be handled

DMARC (Domain-based Message Authentication, Reporting, and Conformance) lets domain owners publish policy for handling emails that fail SPF or DKIM authentication.

Which Microsoft 365 Defender feature allows an admin to submit a suspected false positive email for analysis by Microsoft?

Answer: Submissions portal (admin submissions)

The Submissions portal at security.microsoft.com lets admins submit emails, URLs, and files to Microsoft for analysis to improve filtering accuracy.

Zero-hour Auto Purge (ZAP) in Exchange Online Protection retroactively takes action on messages already delivered to mailboxes. What triggers ZAP?

Answer: When a delivered message is later identified as spam or malware

ZAP monitors delivered messages and, when intelligence updates classify them as spam or malware after delivery, automatically moves or deletes them from mailboxes.