You are a Microsoft 365 administrator for a company. Several users report that they receive emails which have a PDF attachment. The PDF attachment launches malicious code. You need to remove the message from inboxes and disable the PDF threat if an affected document is opened. Which feature should you implement?

Zero-hour auto purge (ZAP) is a protection feature within Exchange Online Protection and Microsoft Defender for Office 365. Its specific function is to retroactively detect and act on malicious messages that have already been delivered to user inboxes. When new threat intelligence determines a delivered message contains malware (such as a malicious PDF), ZAP automatically moves the message to the quarantine or junk folder. This action removes the message from the user's inbox, thereby preventing them from opening the malicious attachment and disabling the threat.

A. Microsoft Exchange Admin Center block lists: Block lists prevent future emails from specific senders or domains but do not retroactively remove messages that have already been delivered.
B. Sender Policy Framework: SPF is an email authentication protocol used to prevent sender address forgery. It does not scan for malware or remove delivered messages.
C. Advanced Threat Protection anti-phishing: While part of the same security suite, anti-phishing policies specifically target impersonation and credential theft attempts, not malware delivered via attachments.
E. DKIM signed messages with mail flow rules: DKIM is an email authentication method. Mail flow rules process messages before they are delivered to the inbox and cannot act retroactively on delivered items.

1. Microsoft Learn. (2024). Zero-hour auto purge (ZAP) in Microsoft Defender for Office 365. Microsoft 365 Security Documentation. Retrieved from https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/zero-hour-auto-purge?view=o365-worldwide.

Section: "ZAP for malware". This section states

"For messages that are found to contain malware after delivery

ZAP quarantines the message that contains the malware." This directly supports the use of ZAP for post-delivery removal of malware.

2. Microsoft Learn. (2024). MS-900: Describe the capabilities of Microsoft security and compliance solutions. Microsoft 365 Fundamentals Learning Path. Retrieved from https://learn.microsoft.com/en-us/training/modules/describe-capabilities-microsoft-security-compliance-solutions/4-describe-threat-protection-microsoft-365.

Section: "Microsoft Defender for Office 365". This official courseware for MS-900 describes ZAP as a feature that "Retroactively detects and neutralizes malicious phishing

spam

or malware messages that have already been delivered to Exchange Online mailboxes."