Microsoft Security Operations Analyst Associate SC-200 Practice Question

The Dynamic Delivery action in a Safe Attachments policy immediately delivers the email body while substituting each original attachment with a temporary placeholder. While users can read the message, the attachments are routed to Microsoft's sandbox environment for detonation-based malware analysis. After the scan completes and the attachments are deemed safe, they are re-attached to the message, allowing users to open them. The Block action would quarantine the entire message, preventing any part of it from reaching the user. Replace leaves the attachments permanently converted to URL links after scanning, and Monitor does not block or delay access to potentially malicious content. Therefore, Dynamic Delivery best meets the stated requirements.