The correct answer is Safe Links rewrites the URL and checks it when the user clicks the link.

Safe Links rewrites URLs in email so that clicks are routed through Microsoft's protection service and the destination is evaluated at the time the user clicks. This time of click scanning can use reputation checks and dynamic analysis and it can block or warn the user if the destination is found to be malicious.

The link opens immediately without any scanning is incorrect because Safe Links does not let the target load without inspection. The click is intercepted and examined before the user is taken to the final site.

Safe Links inspects the URL when the mail system receives and delivers the message is incorrect because the primary behavior of Safe Links is time of click evaluation. Other layers like Exchange Online Protection may do checks at delivery but Safe Links focuses on protecting users when they follow links later.

Safe Links only inspects attachments and does not scan inline links is incorrect because Safe Links is specifically designed to protect against malicious URLs in messages and documents. Attachment scanning is handled by other features such as Safe Attachments.

Full AWS Practitioner Certification Question