MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
This MS-102 practice question tests your understanding of manage security and threats by using microsoft defender xdr. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: emailUrlInfo provides details on URLs found within emails.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should trigger when a user receives a phishing email containing a malicious URL and then clicks that URL within 10 minutes. Which two Advanced Hunting tables must be joined in the KQL query?
EmailEvents tracks email delivery but not URL-specific details; joining directly to UrlClickEvents is not straightforward without URL info.
B
EmailEvents and DeviceProcessEvents
Why wrong: DeviceProcessEvents is for process activities, not email or URL clicks.
C
EmailUrlInfo and UrlClickEvents
EmailUrlInfo contains the URLs in emails, and UrlClickEvents contains user clicks; joining them on relevant fields (like NetworkMessageId) allows detection of clicks after receipt.
D
EmailAttachmentInfo and UrlClickEvents
Why wrong: EmailAttachmentInfo tracks attachments, not URLs; UrlClickEvents is about URL clicks, but without URL details from the email, correlation is not possible.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
EmailEvents and UrlClickEvents
The rule requires detecting when a user receives a phishing email with a malicious URL and then clicks that URL within 10 minutes. The EmailUrlInfo table contains the URL extracted from the email (including the verdict), and the UrlClickEvents table records user clicks on URLs in Microsoft Defender for Office 365 Safe Links. Joining these two tables on the URL hash (SHA256) allows correlation of the email-delivered URL with the user's click event, enabling the time-based trigger.
Key principle: EmailUrlInfo provides details on URLs found within emails.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
EmailEvents and UrlClickEvents
Why this is correct
EmailEvents tracks email delivery but not URL-specific details; joining directly to UrlClickEvents is not straightforward without URL info.
Related concept
EmailUrlInfo provides details on URLs found within emails.
✗
EmailEvents and DeviceProcessEvents
Why it's wrong here
DeviceProcessEvents is for process activities, not email or URL clicks.
✓
EmailUrlInfo and UrlClickEvents
Why this is correct
EmailUrlInfo contains the URLs in emails, and UrlClickEvents contains user clicks; joining them on relevant fields (like NetworkMessageId) allows detection of clicks after receipt.
Related concept
EmailUrlInfo provides details on URLs found within emails.
✗
EmailAttachmentInfo and UrlClickEvents
Why it's wrong here
EmailAttachmentInfo tracks attachments, not URLs; UrlClickEvents is about URL clicks, but without URL details from the email, correlation is not possible.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often assume EmailEvents is needed to capture the email reception, but the URL-to-click correlation requires the URL-specific table (EmailUrlInfo) rather than the email metadata table, and UrlClickEvents is the only table that records the click action.
Detailed technical explanation
How to think about this question
Under the hood, EmailUrlInfo stores each URL extracted from an email along with its SHA256 hash (UrlHash), and UrlClickEvents records clicks with the same hash, allowing a direct join. The 10-minute window is implemented using the KQL `where` clause with `datetime_diff('minute', ClickTimestamp, EmailTimestamp) <= 10`. In real-world scenarios, this detection catches users who click a malicious link shortly after receiving the email, bypassing initial Safe Links time-of-click checks if the URL was later weaponized.
KKey Concepts to Remember
EmailUrlInfo provides details on URLs found within emails.
UrlClickEvents logs user interactions with URLs, including clicks.
NetworkMessageId is a common field for joining email-related tables.
Advanced Hunting queries use KQL (Kusto Query Language).
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
EmailUrlInfo provides details on URLs found within emails.
Real-world example
How this comes up in practice
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. EmailUrlInfo provides details on URLs found within emails. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this MS-102 question in full detail.
Manage security and threats by using Microsoft Defender XDR — This question tests Manage security and threats by using Microsoft Defender XDR — EmailUrlInfo provides details on URLs found within emails..
What is the correct answer to this question?
The correct answer is: EmailEvents and UrlClickEvents — The rule requires detecting when a user receives a phishing email with a malicious URL and then clicks that URL within 10 minutes. The EmailUrlInfo table contains the URL extracted from the email (including the verdict), and the UrlClickEvents table records user clicks on URLs in Microsoft Defender for Office 365 Safe Links. Joining these two tables on the URL hash (SHA256) allows correlation of the email-delivered URL with the user's click event, enabling the time-based trigger.
What should I do if I get this MS-102 question wrong?
Review emailUrlInfo provides details on URLs found within emails., then practise related MS-102 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
EmailUrlInfo provides details on URLs found within emails.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.