Explanation:

Explanation:

Box 1: Anti-malware
Customize the common attachments filter.
See step 5 below.
1. Use the Microsoft Defender XDR portal to create anti-malware policies In the Microsoft Defender XDR portal at https://security.microsoft.com, go to Email & Collaboration > Policies & Rules > Threat policies > Anti-Malware in the Policies section. To go directly to the Anti-malware page, use https://security.microsoft.com/antimalwarev2
2. On the Anti-malware page, select Create to open the new anti-malware policy wizard.
On the Name your policy page, configure these settings:
Name: Enter a unique, descriptive name for the policy.
Description: Enter an optional description for the policy.
3. When you ' re finished on the Name your policy page, select Next.
4. On the Users and domains page, identify the internal recipients that the policy applies to (recipient conditions)
5. On the Protection settings page, configure the following settings:
Protection settings section:
Enable the common attachments filter: If you select this option, messages with the specified attachments are treated as malware and are automatically quarantined. You can modify the list by clicking Customize file types and selecting or deselecting values in the list.
6. Etc.
Box 2: Anti-phishing
Enable impersonation protection for sender domains.
Anti-phishing policies in Microsoft 365
The high-level differences between anti-phishing policies in EOP and anti-phishing policies in Defender for Office 365 are described in the following table:

Reference:
https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-malware-policies-configure
https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-phishing-policies-about

Explanation:

Reference:
https://docs.microsoft.com/en-us/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide
https://docs.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide

Explanation:

Box 1: No
Box 2: Yes
Box 3: No
Reference:
https://docs.microsoft.com/en-us/office365/securitycompliance/retention-policies

Explanation:
Always be able to request the User Administrator role: Setting " Allow permanent eligible assignment to Yes
" ensures that users can always request the User Administrator role when needed.
Must provide a reason when requesting the User Administrator role: Selecting " Require justification on activation " ensures that users must provide a reason each time they activate the User Administrator role, which adds a layer of accountability and tracking.
Must require MFA when activating the User Administrator role: Setting " Require Azure Multi-Factor Authentication on active assignment to Yes " ensures that users must perform MFA to activate the User Administrator role, enhancing security.