MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should trigger when a user receives a phishing email containing a malicious URL and then clicks that URL within 10 minutes. Which two Advanced Hunting tables must be joined in the KQL query?
⚠ Common exam trap
Candidates often assume that only one combination is correct, but both EmailEvents+UrlClickEvents (via NetworkMessageId) and EmailUrlInfo+UrlClickEvents (via UrlHash) are valid ways to link the email to the click. The trick is recognizing that EmailEvents is indeed needed when using that path, and EmailUrlInfo is not required if you directly join on NetworkMessageId.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
EmailEvents and UrlClickEvents
The rule requires detecting when a user receives a phishing email with a malicious URL and then clicks that URL within 10 minutes. Two separate joins can accomplish this: - **EmailEvents and UrlClickEvents**: EmailEvents contains metadata about email delivery (including NetworkMessageId), and UrlClickEvents records user clicks on URLs in Microsoft Defender for Office 365 Safe Links. Joining these tables on NetworkMessageId (and optionally URL hash) allows correlating the email receipt with the click event, enabling the time-based trigger. - **EmailUrlInfo and UrlClickEvents**: EmailUrlInfo provides details on URLs found within emails (including the URL and its verdict), and UrlClickEvents logs clicks. Joining on the URL hash (SHA256) directly correlates the email-delivered URL with the user's click, also enabling the time-based trigger. Both pairs are valid and commonly used depending on the specific data needed. Option B (DeviceProcessEvents) is irrelevant as it deals with process execution, not email or URL clicks. Option D (EmailAttachmentInfo) pertains to attachments, not URLs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
EmailEvents and UrlClickEvents
Why this is correct
EmailEvents tracks email delivery metadata only, such as sender, recipient, subject, delivery action, and message ID, but it does not enumerate the URLs contained in the message body. UrlClickEvents references the clicked URL but does not include the email's NetworkMessageId unless the URL was part of a Safe Links click from an email, and even then you need URL information to correlate. Without the URL-to-email mapping that EmailUrlInfo provides, joining EmailEvents to UrlClickEvents is not straightforward and would require a separate enrichment step, so this pairing is incorrect for URL-click detection.
- ✗
EmailEvents and DeviceProcessEvents
Why it's wrong here
DeviceProcessEvents is an endpoint table that records process creation events, including command lines, parent processes, and file hashes, but it has no relationship to email content, URL clicks, or delivery events. EmailEvents describes the email flow itself, but combining it with process events would only be useful if you had an independent link from an email to a process (e.g., an attachment launch), which this pairing lacks. This combination cannot detect clicks on URLs because click telemetry exists in UrlClickEvents, not in any process event table.
- ✓
EmailUrlInfo and UrlClickEvents
Why this is correct
EmailUrlInfo is the advanced hunting table that maps each email (via NetworkMessageId) to the individual URLs embedded in that message, including the URL and any verdict data. UrlClickEvents records when a user clicks a URL from an email or Safe Links in Microsoft 365. Joining these two tables on NetworkMessageId (and often the URL entity) lets you detect clicks that occur after an email containing a specific URL is received, which is exactly the scenario for a custom detection rule.
- ✗
EmailAttachmentInfo and UrlClickEvents
Why it's wrong here
EmailAttachmentInfo contains metadata about email attachments, such as file names, SHA256 hashes, file sizes, and the NetworkMessageId of the email that carried the attachment. UrlClickEvents tracks URL click behavior, but it is not related to attachment interactions; opening an attachment is not recorded in UrlClickEvents. Even if you attempted a join, there is no common key between attached file hashes and clicked URLs, so this pairing would not produce meaningful detection for email URL click activity and is therefore incorrect for this rule.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every MS-102 question from scratch — 241 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.