Microsoft 365 Administrator Expert MS-102 Practice Question

The alert policy Activity determines which event in Microsoft 365 generates the alert. The event that records ZAP removing a malicious message after delivery is "Malware detected after delivery in email". This activity is logged whenever ZAP re-scans a previously delivered message, identifies malware, and moves the message to quarantine. Selecting other activities would monitor different events: phishing ZAP actions, initial malware detection at time-of-delivery, or user-reported messages, none of which satisfy the requirement to alert only when ZAP removes malware post-delivery.