The answer is EmailUrlInfo and DeviceNetworkEvents. This is correct because detecting a phishing email click requires correlating the URL from the email with the device’s outbound network connection to a malicious domain. EmailUrlInfo stores the URLs embedded in received emails, while DeviceNetworkEvents logs every network connection initiated from a device, including the destination domain. By joining these two tables on the URL or domain, you can confirm that a user not only received a malicious link but also clicked it from their device. On the MS-102 exam, this tests your ability to design custom detection rules in Microsoft Defender XDR using advanced hunting queries, a common scenario for security analysts. A frequent trap is confusing EmailEvents (which tracks email delivery) with EmailUrlInfo—remember that only EmailUrlInfo contains the actual clickable URLs. For a memory tip, think “Email link lands in inbox, Device click lands in network log,” so join the URL table with the network table to catch the full attack chain.
MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
This MS-102 practice question tests your understanding of manage security and threats by using microsoft defender xdr. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: emailUrlInfo table records details about URLs in emails and user click actions.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security analyst wants to create a custom detection rule in Microsoft Defender XDR that triggers when a user receives a phishing email and later clicks a link to a known malicious domain from their device. The rule will use advanced hunting queries. Which two tables should be joined to detect the click event from the device?
Why wrong: EmailEvents does not contain click information; EmailUrlInfo has click data but joining only those two does not relate to the device network connection.
B
EmailEvents and DeviceNetworkEvents
This combination lacks the URL click info from EmailUrlInfo that indicates the user clicked the link.
C
EmailUrlInfo and DeviceNetworkEvents
EmailUrlInfo records URL clicks, and DeviceNetworkEvents records network connections; joining on URL hash and timestamp links the click to the device connection.
D
EmailAttachmentInfo and DeviceProcessEvents
Why wrong: EmailAttachmentInfo is for file attachments, not URLs, and DeviceProcessEvents does not capture network connections to URLs.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
EmailEvents and DeviceNetworkEvents
Option C is correct because detecting a user clicking a link to a known malicious domain from their device requires joining the email URL information (EmailUrlInfo) with the device-level network event (DeviceNetworkEvents). EmailUrlInfo contains the URLs from emails, and DeviceNetworkEvents records outbound network connections from devices, including the destination domain. Joining these tables on the URL or domain allows you to correlate the email link with the subsequent device click event.
Key principle: EmailUrlInfo table records details about URLs in emails and user click actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
EmailEvents and EmailUrlInfo
Why it's wrong here
EmailEvents does not contain click information; EmailUrlInfo has click data but joining only those two does not relate to the device network connection.
✓
EmailEvents and DeviceNetworkEvents
Why this is correct
This combination lacks the URL click info from EmailUrlInfo that indicates the user clicked the link.
Related concept
EmailUrlInfo table records details about URLs in emails and user click actions.
✓
EmailUrlInfo and DeviceNetworkEvents
Why this is correct
EmailUrlInfo records URL clicks, and DeviceNetworkEvents records network connections; joining on URL hash and timestamp links the click to the device connection.
Related concept
EmailUrlInfo table records details about URLs in emails and user click actions.
✗
EmailAttachmentInfo and DeviceProcessEvents
Why it's wrong here
EmailAttachmentInfo is for file attachments, not URLs, and DeviceProcessEvents does not capture network connections to URLs.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often assume EmailEvents contains all necessary email data, but the click event requires device-level network logs, and the specific URL must be matched via EmailUrlInfo, not just the email metadata.
Detailed technical explanation
How to think about this question
Under the hood, DeviceNetworkEvents captures outbound connections using the Windows Filtering Platform (WFP) and includes fields like RemoteUrl, RemoteIP, and RemotePort. EmailUrlInfo stores URLs extracted from email bodies and attachments, with fields such as Url and Domain. The join typically uses the domain or URL to correlate the phishing email's link with the device's DNS resolution or HTTP connection, enabling detection of the click event even if the user accesses the link from a different browser or application.
KKey Concepts to Remember
EmailUrlInfo table records details about URLs in emails and user click actions.
DeviceNetworkEvents table logs all network connections made by onboarded devices.
Joining these tables correlates email-borne URL clicks with device-initiated network traffic.
Advanced Hunting queries use KQL to join tables and create custom detection rules.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
EmailUrlInfo table records details about URLs in emails and user click actions.
Real-world example
How this comes up in practice
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this MS-102 question in full detail.
Review emailUrlInfo table records details about URLs in emails and user click actions., then practise related MS-102 questions on the same topic to reinforce the concept.
Manage security and threats by using Microsoft Defender XDR — This question tests Manage security and threats by using Microsoft Defender XDR — EmailUrlInfo table records details about URLs in emails and user click actions..
What is the correct answer to this question?
The correct answer is: EmailEvents and DeviceNetworkEvents — Option C is correct because detecting a user clicking a link to a known malicious domain from their device requires joining the email URL information (EmailUrlInfo) with the device-level network event (DeviceNetworkEvents). EmailUrlInfo contains the URLs from emails, and DeviceNetworkEvents records outbound network connections from devices, including the destination domain. Joining these tables on the URL or domain allows you to correlate the email link with the subsequent device click event.
What should I do if I get this MS-102 question wrong?
Review emailUrlInfo table records details about URLs in emails and user click actions., then practise related MS-102 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
EmailUrlInfo table records details about URLs in emails and user click actions.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.