Manage security and threats by using Microsoft Defender XDR →easyMultiple Choice

MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR

Exhibit

Refer to the exhibit.

```kusto
EmailEvents
| where Timestamp > ago(30d)
| where EmailDirection == "Inbound"
| where DeliveryAction == "Blocked"
| summarize BlockedCount = count() by SenderDomain
| top 10 by BlockedCount
```

You run the above KQL query in Microsoft Defender XDR Advanced Hunting. The query returns no results. What is the most likely reason?

⚠ Common exam trap

MS-102 often tests knowledge of the exact column names in Advanced Hunting tables, and candidates may assume a column exists based on common sense rather than verifying the schema.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The column name SenderDomain does not exist in EmailEvents.

The most likely reason is that the column name 'SenderDomain' does not exist in the EmailEvents table. In Microsoft Defender XDR Advanced Hunting, the EmailEvents table contains columns like 'SenderFromDomain' or 'SenderMailFromDomain', but not 'SenderDomain'. Therefore, the query would fail to return results because of an invalid column reference.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The EmailDirection filter should be 'Outbound'.
Why it's wrong here
In EmailEvents, the EmailDirection field must retain the value 'Inbound' because the query intends to isolate messages that arrived from external senders and were blocked. Changing it to 'Outbound' would exclude the very signaling chain of inbound phishing or spam messages. The correct filter is therefore already set, and adjusting it would not resolve the schema error.
✗
No inbound emails were blocked in the last 30 days.
Why it's wrong here
Although a tenant could theoretically have zero blocked inbound messages over a month, that is highly unusual for any Microsoft 365 organization with standard Exchange Online Protection or Defender safeguards. More importantly, this option misinterprets the failure: the KQL query would throw a schema error immediately because of the invalid 'SenderDomain' column, so it wouldn't return a legitimate empty result set. Lack of blocked mail is therefore neither the likely nor the correct diagnosis.
✗
The time range should be 7 days instead of 30 days.
Why it's wrong here
The 30-day lookback in the query is a valid, even recommended, range for hunting inbound threats in Advanced Hunting because EmailEvents retention is 30 days and longer windows improve detection of low-volume campaigns. There is no technical constraint that forces 7 days. The query's failure stems from the nonexistent SenderDomain column, not from the time filter, so switching to 7 days would leave the same schema error.
✓
The column name SenderDomain does not exist in EmailEvents.
Why this is correct
EmailEvents in Microsoft 365 Defender Advanced Hunting does not contain a column named SenderDomain; the domain can be accessed through SenderMailFromDomain (envelope domain) or SenderFromDomain (display domain). Because the query references an invalid schema field, the entire query fails with a recognized column not found error before any rows can be processed. Using the correct domain column would allow the hunt to run.

Go deeper

MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question