Anti-phishing is correct because Microsoft 365 Defender uses its anti-phishing policies to detect and block unauthenticated and impersonated senders before messages reach employees.

The Anti-phishing policy includes checks for sender authentication and impersonation. It uses signals such as SPF DKIM and DMARC and includes spoof intelligence and mailbox intelligence to stop messages that pretend to be from trusted senders or domains.

Safe Attachments is incorrect because it focuses on scanning and sandboxing attachments to detect malware rather than validating who sent the message.

Anti-spam is incorrect because it targets bulk and unsolicited messages with spam filtering heuristics and reputation checks rather than enforcing sender authentication and impersonation protections.

Safe Links is incorrect because it rewrites and scans URLs to protect users from malicious links and does not perform sender authentication checks.

Full AWS Practitioner Certification Question