You have a Microsoft 365 subscription and Microsoft 365 E5 licenses assigned to your users. You are using Microsoft Defender for Office 365, and you configure a safe attachment policy for your Sales department. You want the emails containing malicious attachments to be delivered without the attachment. How should you configure the policy?

Answer options:

A.Block
B.Replace
C.Dynamic Delivery
D.Monitor

Correct Answer: B 
You should configure the policy with the Replace-control. When enabled, detected malware attachments will be removed, but the message will be delivered (without the attachment).
Option A is incorrect.This control prevents messages with detected malware attachments from being delivered.
Option C is incorrect. This control replaces the attachment with a placeholder until the Safe attachment scanning is complete. If found to be safe, the attachment is then released to the user. 
Option D is incorrect. This control only tracks what happens with detected malware.
Reference: 
To know more about Safe attachment configurations, please refer to the link below: 

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-attachments?view=o365-worldwide