A Microsoft 365 administrator is configuring Microsoft Defender for Office 365. The organization wants to ensure that all email messages containing specific sensitive keywords (e.g., 'Confidential Project X', 'Patent Application Y') are quarantined before delivery to user inboxes. Which type of policy should the administrator create?
- ASafe Attachments policy
- BAnti-malware policy
- CAnti-phishing policy
- DContent filter policy (Mail flow rule)
Show answer & explanationAnswer & explanation
Correct answer: D. Content filter policy (Mail flow rule)
To quarantine emails based on specific keywords in their content, a mail flow rule (also known as a transport rule) with a content filter condition is the most appropriate solution. While Defender for Office 365 policies (A, B, C) handle various threats, they are not designed for custom keyword-based content filtering and quarantining in the same way a mail flow rule is. Mail flow rules provide granular control over email routing and actions based on message properties, including content.
Why the other options are wrong
- A. Safe Attachments policies detonate attachments in a sandbox environment to detect zero-day malware, not to filter based on keywords in the email content.
- B. Anti-malware policies scan for malicious attachments and files, not specific text strings in the email body or subject.
- C. Anti-phishing policies detect and prevent phishing attempts based on various indicators (spoofing, impersonation, phishing links), not specific content keywords.
Mail Flow Rules for Content Filtering
Mail flow rules (transport rules) in Exchange Online (part of Microsoft 365) allow administrators to apply specific actions, such as quarantining, to email messages based on conditions like the presence of sensitive keywords in the message content.
- Configured in Exchange admin center or Microsoft 365 Defender portal.
- Use conditions to match message properties (sender, recipient, content).
- Apply actions like quarantine, reject, redirect, add disclaimers.
- Highly customizable for specific content filtering needs.
Memory trick: Remember, for 'Custom Content' 'Filtering' and 'Quarantine', 'Mail Flow Rules' are your 'Go-to'.