Finance staff report business email compromise attempts that try to hijack municipal payment conversations. Which Microsoft 365 approach best addresses that email account compromise threat at describe depth?
Select an answer to reveal the explanation.
Short Explanation
Business email compromise is social engineering wearing a trusted mailbox. You harden the mail path with Defender for Office 365 and harden sign-in with MFA-style identity controls. Whiteboard colors, Loop alone, or Autopatch rings are not the BEC answer.
Full Explanation
Defender for Office 365 protections plus strong identity controls such as MFA best address business email compromise attempts that try to hijack municipal payment conversations at describe depth. BEC blends malicious or spoofed email with account-takeover risk, so cities need both collaboration-content protections and strong sign-in controls for finance staff. MS-900 expects that paired answer rather than whiteboard colors or update rings as anti-fraud magic.
Whiteboard ink colors are not anti-fraud controls for payment email compromise. Loop components without mailbox protections do not stop BEC. Autopatch rings manage Windows updates and are not the only BEC control.
An exam caveat is that finance process controls—out-of-band payment verification—still complement the Microsoft 365 stack, but the product pairing on the exam is Defender for Office 365 with MFA. Operationally, harden finance mailboxes with Defender for Office 365 protections, require MFA for those accounts, review Impersonation or phishing alerts tied to payment threads, and add a procedural callback step for vendor bank-detail changes. Finance supervisors should rehearse a simple callback script for vendor payment changes so technical controls and human verification reinforce each other during month-end cycles. Documenting that dual control in the city’s disbursement procedure closes the gap attackers exploit when only one layer is strong.