The answer is the EmailUrlInfo table. This is the correct choice because EmailUrlInfo in Microsoft Defender XDR Advanced Hunting specifically stores records of every URL found in email messages, including the URL domain and a critical column called ClickAction that indicates whether the link was clicked. By joining EmailEvents with EmailUrlInfo on the NetworkMessageId, a security analyst can trace the full chain from email receipt to link click, enabling detection of phishing campaigns targeting known malicious domains. On the MS-102 exam, this question tests your understanding of Advanced Hunting schema relationships and the specific purpose of each email-related table—a common trap is confusing EmailUrlInfo with EmailAttachmentInfo or UrlClickEvents, which track different data. Remember that EmailUrlInfo is about URLs *in* the email body, not browser clicks. A helpful memory tip: think “EmailUrlInfo = email content URLs,” and if you need to track the actual click action, always check the ClickAction column in this table.
MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
This MS-102 practice question tests your understanding of manage security and threats by using microsoft defender xdr. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: emailUrlInfo tracks URLs found in emails and user interactions with them.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security analyst wants to create a custom detection rule in Microsoft Defender XDR that triggers when a user receives a phishing email and clicks a link to a known malicious domain. Which advanced hunting table should the analyst query to track the clicked URL?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
EmailUrlInfo
The EmailUrlInfo table in Advanced Hunting for Microsoft Defender XDR contains records of URLs that were present in emails, including the URL domain and whether the link was clicked. By joining EmailEvents with EmailUrlInfo on the NetworkMessageId, the analyst can identify when a user clicked a URL that leads to a known malicious domain, making it the correct table for tracking clicked URLs.
Key principle: EmailUrlInfo tracks URLs found in emails and user interactions with them.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
EmailEvents
Why it's wrong here
EmailEvents contains delivery status, sender, and recipient info but does not include URL click data.
✓
EmailUrlInfo
Why this is correct
EmailUrlInfo includes the URL, click status, and other URL-related details, making it suitable for tracking clicked links.
Related concept
EmailUrlInfo tracks URLs found in emails and user interactions with them.
✗
EmailAttachmentInfo
Why it's wrong here
This table provides information about attachments in emails, not URLs.
✗
DeviceEvents
Why it's wrong here
DeviceEvents records actions on endpoints, such as process creation, but not email URL clicks.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse EmailUrlInfo (which stores URL metadata and supports click tracking) with EmailEvents (which only contains email flow data), leading them to incorrectly select EmailEvents as the primary table for URL click analysis.
Detailed technical explanation
How to think about this question
The EmailUrlInfo table stores each URL extracted from an email body or attachment, with fields like Url, UrlDomain, and ReportId. To detect a click, the analyst must join EmailUrlInfo with EmailEvents on NetworkMessageId and then filter for events where the user clicked the link (e.g., using the ClickAction field in EmailEvents). In a real-world scenario, this query can be combined with threat intelligence feeds to flag clicks on newly observed malicious domains before they are blocked by URL reputation filters.
KKey Concepts to Remember
EmailUrlInfo tracks URLs found in emails and user interactions with them.
It includes details like Url, ClickAction, ClickResult, and ThreatType.
This table is crucial for investigating user clicks on malicious links.
EmailUrlInfo supports advanced hunting queries for post-delivery URL analysis.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
EmailUrlInfo tracks URLs found in emails and user interactions with them.
Real-world example
How this comes up in practice
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this MS-102 question in full detail.
Review emailUrlInfo tracks URLs found in emails and user interactions with them., then practise related MS-102 questions on the same topic to reinforce the concept.
Manage security and threats by using Microsoft Defender XDR — This question tests Manage security and threats by using Microsoft Defender XDR — EmailUrlInfo tracks URLs found in emails and user interactions with them..
What is the correct answer to this question?
The correct answer is: EmailUrlInfo — The EmailUrlInfo table in Advanced Hunting for Microsoft Defender XDR contains records of URLs that were present in emails, including the URL domain and whether the link was clicked. By joining EmailEvents with EmailUrlInfo on the NetworkMessageId, the analyst can identify when a user clicked a URL that leads to a known malicious domain, making it the correct table for tracking clicked URLs.
What should I do if I get this MS-102 question wrong?
Review emailUrlInfo tracks URLs found in emails and user interactions with them., then practise related MS-102 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
EmailUrlInfo tracks URLs found in emails and user interactions with them.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst is creating a custom detection rule in Microsoft 365 Defender Advanced Hunting. The rule should trigger when a user receives a phishing email containing a malicious URL and then clicks that URL within 10 minutes. Which two Advanced Hunting tables must be joined in the KQL query?
medium
✓ A.EmailEvents and UrlClickEvents
B.EmailEvents and DeviceProcessEvents
✓ C.EmailUrlInfo and UrlClickEvents
D.EmailAttachmentInfo and UrlClickEvents
Why A: The rule requires detecting when a user receives a phishing email with a malicious URL and then clicks that URL within 10 minutes. The EmailUrlInfo table contains the URL extracted from the email (including the verdict), and the UrlClickEvents table records user clicks on URLs in Microsoft Defender for Office 365 Safe Links. Joining these two tables on the URL hash (SHA256) allows correlation of the email-delivered URL with the user's click event, enabling the time-based trigger.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.