mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: A security analyst in Microsoft 365 Defender is…
A security analyst in Microsoft 365 Defender is investigating an email-based threat. The analyst needs to find all emails that were initially delivered to user inboxes but were later remediated (e.g., moved to junk, deleted, or quarantined) by Zero-Hour Auto Purge (ZAP). Which advanced hunting tables should the analyst query to get both the original email metadata and the post-delivery remediation events?
⚠ Common exam trap
A common mix-up: candidates think EmailPostDeliveryEvents alone suffices, but without EmailEvents you cannot confirm the original delivery status (e.g., 'Delivered') which is essential to distinguish ZAP from other post-delivery actions like manual user moves.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
EmailEvents and EmailPostDeliveryEvents
To investigate emails that were initially delivered but later remediated by Zero-Hour Auto Purge (ZAP), you need both the original email metadata (from EmailEvents) and the post-delivery remediation actions (from EmailPostDeliveryEvents). EmailEvents provides details like sender, recipient, subject, and delivery status, while EmailPostDeliveryEvents records ZAP actions such as moving to junk, deleting, or quarantining. Querying these two tables together allows you to correlate the initial delivery with the subsequent remediation event.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
EmailEvents and EmailPostDeliveryEvents
Why this is correct
Correct. EmailEvents has delivery info; EmailPostDeliveryEvents has ZAP and other post-delivery actions.
- ✗
EmailEvents and EmailAttachmentInfo
Why it's wrong here
EmailAttachmentInfo contains file attachment metadata, not post-delivery remediation actions.
- ✗
EmailPostDeliveryEvents and EmailUrlInfo
Why it's wrong here
EmailUrlInfo contains URL information, not the original delivery metadata needed for correlation.
- ✗
EmailEvents and CloudAppEvents
Why it's wrong here
CloudAppEvents is for cloud app activities, not email-specific post-delivery events.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.