All employees at a company have Exchange Online mailboxes.
You observe a surge in email messages that contain malware. You determine that all of the messages originate from a single IP address.
You need to ensure that no email messages from the IP address are delivered to the users.
What should you do? center (EAC). The connection filter policy settings are applied to inbound messages only. https://technet.microsoft.com/en-us/library/jj200718(v=exchg.150).aspx

A.
Create a malware filter.

B.
Create a connection filter.

C.
Create a content filter.

D.
Create a new transport rule.

Explanation:

You can create an IP Allow list or IP Block list by editing the connection filter policy in the Exchange admin
References: