Question

A financial services company is repeatedly targeted by business email compromise (BEC) attacks. Attackers register look-alike domains (e.g., contoso-finance.com instead of contoso.com) and spoof the display names of the CFO and treasury team to trick staff into wiring funds. The security architect must design a Defender for Office 365 configuration that specifically detects and mitigates these display-name and domain look-alike attacks against a defined list of high-value executives. Which configuration should be prioritized?

Accepted Answer

Configure an anti-phishing policy with mailbox intelligence and user/domain impersonation protection, adding the executives and the company's protected domains to the impersonation lists

Answer

Enable Safe Attachments with Dynamic Delivery so that malicious payloads are detonated before delivery to the executives' mailboxes

Answer

Configure Safe Links policies to rewrite and time-of-click scan URLs contained in inbound messages to the executives

Answer

Create an anti-spam inbound policy with an aggressive bulk complaint level (BCL) threshold applied to the executives' mailboxes