The correct options are Anti-spam filtering, Anti-malware scanning, and Zero hour automatic message removal.

Anti-spam filtering is a core capability that blocks unsolicited and bulk email before it reaches user inboxes and it is commonly included in base email protection subscriptions because it reduces noise and lowers the risk of users interacting with malicious messages.

Anti-malware scanning inspects attachments and message content for known malware signatures and heuristics so that malicious files are detected and quarantined or blocked as part of the standard threat management stack.

Zero hour automatic message removal lets the service retroactively remove or quarantine messages after delivery when a new threat is identified and it provides an important safety net for threats that are discovered after emails were allowed through.

Protection against malicious URLs and attachments is listed as incorrect because URL rewriting and advanced attachment sandboxing are often provided by higher tier features such as Safe Links and Safe Attachments rather than by the most basic bundled subscription.

Advanced anti-phishing controls is incorrect because advanced phishing protection typically includes sophisticated impersonation detection and automated threat response and those controls are usually part of an upgraded or separate product tier.

Full AWS Practitioner Certification Question