Safe Attachments policy must be created first when using PowerShell to add a Safe Attachments rule for an organization.

The Safe Attachments policy is the resource that defines how attachments are scanned and what actions are taken when a threat is detected. A rule references and applies that policy to messages so you must have the policy in place before you create or bind the rule in PowerShell.

Safe Attachments condition is not the right choice because conditions are pieces of rule logic that you specify when building the rule. Conditions are configured as part of the rule and they do not exist independently before the policy and rule are created.

Safe Links policy is a separate protection feature that focuses on URLs and it does not provide the attachment scanning configuration that Safe Attachments policies provide. Creating a Safe Links policy will not satisfy the requirement for a Safe Attachments rule.

Safe Attachments exception is not created first because exceptions are adjustments to existing policies or rules. You add exceptions after the main policy or rule exists so an exception cannot be the initial object you create.

Full AWS Practitioner Certification Question