Exam MS-500 topic 2 question 28 discussion

This is incorrect. By default both go to Junk Mail, only high confidence phishing goes to Quarantine.

People should really test and verify themselves before giving answers. Both go to junk mail. The default value for the default anti-philshing policy is that it goes to junk. You have to actually modify it to go into quarantine.

Guys relax, this is correct. " By default, messages that are classified as spam or bulk are delivered to the recipient's Junk Email folder, while messages classified as phishing are quarantined." Source: https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spam-protection-faq?view=o365-worldwide#by-default--what-happens-to-a-spam-detected-message-

"By default, messages that are classified as spam or bulk are delivered to the recipient's Junk Email folder, while messages classified as phishing are quarantined." - Reference: https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spam-protection-faq?view=o365-worldwide#by-default--what-happens-to-a-spam-detected-message-

In the Anti-spam policy, default for phishing messages is to go to quarantine. In Anti-phishing policy, default for 'spoof' is junk Question doesn't clearly state what policy we are creating?

Email from spoofed senders (the From address of the message doesn't match the source of the message) is classified as phishing in Defender for Office 365. Sometimes spoofing is benign, and sometimes users don't want messages from specific spoofed sender to be quarantined. To minimize the impact to users, periodically review the spoof intelligence insight, the Spoofed senders tab in the Tenant Allow/Block List, and the Spoof detections report. Once you have reviewed allowed and blocked spoofed senders and made any necessary overrides, you can be confident to configure spoof intelligence in anti-phishing policies to Quarantine suspicious messages instead of delivering them to the user's Junk Email folder. https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-phishing-protection-tuning?view=o365-worldwide

Copied from Anti spam inbound policy Actions  Spam message action Move message to Junk Email folder High confidence spam message action Move message to Junk Email folder Phishing message action Move message to Junk Email folder

Just double check most recent table - and note the (*) As of today, Phishing is Quarantined by default https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/configure-your-spam-filter-policies?view=o365-worldwide

"By default, messages that are classified as spam or bulk are delivered to the recipient's Junk Email folder, while messages classified as phishing are quarantined." ->https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spam-protection-faq?view=o365-worldwide

Both go to Junk!

as of today - By default, anti-spam polices quarantine phishing and high confidence phishing messages, and deliver spam, high confidence spam, and bulk email messages to the user's Junk Email folder

Move to Junk is the default. Quarantine has to be configured - https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-anti-phishing-policies?view=o365-worldwide

An asterisk ( * ) after the check mark indicates the default action for the spam filtering verdict. Action Move message to Junk Email folder: The message is delivered to the mailbox and moved to the Junk Email folder. Spam Highconfidencespam Phishing Highconfidencephishing Bulk Check mark.* Check mark.* Check mark. Check mark Check mark* Quarantine message: Sends the message to quarantine instead of the intended recipients. Spam Highconfidencespam Phishing Highconfidencephishing Bulk Check mark. Check mark Check mark* Check mark* Check mark See: https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/configure-your-spam-filter-policies?view=o365-worldwide

Both go to JUNK.

messages that contain word filtered content > Junk https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/advanced-spam-filtering-asf-options?view=o365-worldwide "Messages that contain words from the sensitive word list in the subject or message body are marked as high confidence spam." So by default anti-spam policy it would go to users Junk folder. messages that are classified as phishing > Quarantine https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/quarantine-email-messages?view=o365-worldwide By default, anti-spam polices quarantine phishing and high confidence phishing messages, and deliver spam, high confidence spam, and bulk email messages to the user's Junk Email folder. You need to customize anti-spam policies if you need to quarantine them.

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/quarantine-email-messages?view=o365-worldwide Both ans are JUNK, JUNK Q1 : Messages that are classified as Phishing: Correct Ans. JUNK By default, anti-spam polices quarantine phishing and high confidence phishing messages, and deliver spam, high confidence spam, and bulk email messages to the user's Junk Email folder. You need to customize anti-spam policies if you need to quarantine them. Q1 : Messages that contain word-filtered content: Correct Ans. JUNK From this page: https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/advanced-spam-filtering-asf-options?view=o365-worldwide "Messages that contain words from the sensitive word list in the subject or message body are marked as high confidence spam." So by default anti-spam policy it would go to users Junk folder.

Junk , Junk : By default, anti-spam polices quarantine phishing and high confidence phishing messages, and deliver spam, high confidence spam, and bulk email messages to the user's Junk Email folder.