SC-100 Certification Practice Question #78

Question

You have a Microsoft 365 subscription that contains 1,000 Microsoft Exchange Online mailboxes.

Incoming email from the internet is scanned for security threats by using a third-party cloud service.

You are evaluating whether to replace the third-party service with Microsoft Defender for Office 365.

What should you modify to ensure that all the incoming email is scanned by Defender for Office 365 only?

Accepted Answer

To guarantee that *all* incoming internet email is scanned by Defender for Office 365 **only**, inbound mail must hit Microsoft first. That is controlled by the public MX (DNS) record: with the third-party service in front, the MX points to it; changing the MX record to `<domain>.mail.protection.outlook.com` makes Microsoft the first and only inbound filter. MS Learn's Defender for Office 365 deployment guidance requires the public MX record to resolve directly to Microsoft 365 for inbound external email to be scanned by the built-in security stack. The official Suggested Answer (B), the dominant Most Voted (B, 14 votes), and the strongest doc-cited comments all converge on DNS records. The D (connectors) minority is discounted because connectors only reroute mail you choose to send to Microsoft and can't guarantee exclusivity while the MX still resolves to the third party.

More SC-100 practice questions