mediumMultiple Choice
SC-200 Practice Question: A security analyst in Microsoft 365 Defender is…
A security analyst in Microsoft 365 Defender is investigating an email-based threat. The analyst needs to find all emails that were initially delivered to user inboxes but were later remediated (e.g., moved to junk, deleted, or quarantined) by Zero-Hour Auto Purge (ZAP). Which advanced hunting tables should the analyst query to get both the original email metadata and the post-delivery remediation events?
⚠ Common exam trap
A common mix-up: candidates think EmailPostDeliveryEvents alone suffices, but without EmailEvents you cannot confirm the original delivery status (e.g., 'Delivered') which is essential to distinguish ZAP from other post-delivery actions like manual user moves.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
EmailEvents and EmailPostDeliveryEvents
To investigate emails that were initially delivered but later remediated by Zero-Hour Auto Purge (ZAP), you need both the original email metadata (from EmailEvents) and the post-delivery remediation actions (from EmailPostDeliveryEvents). EmailEvents provides details like sender, recipient, subject, and delivery status, while EmailPostDeliveryEvents records ZAP actions such as moving to junk, deleting, or quarantining. Querying these two tables together allows you to correlate the initial delivery with the subsequent remediation event.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
EmailEvents and EmailPostDeliveryEvents
Why this is correct
EmailEvents supplies the original delivery metadata, while EmailPostDeliveryEvents records post-delivery actions including ZAP moves to junk, deletion, or quarantine. Querying both satisfies the requirement to correlate initial inbox delivery with later remediation, since ZAP outcomes are logged only in EmailPostDeliveryEvents, not in EmailEvents.
- ✗
EmailEvents and EmailAttachmentInfo
Why it's wrong here
EmailAttachmentInfo holds attachment metadata (file names, hashes, verdicts), not post-delivery remediation actions. It is tempting because pairing it with EmailEvents enriches attachment-level investigation, which is correct when triaging malicious files in delivered mail, but ZAP remediation events live in EmailPostDeliveryEvents, so this pair cannot show the move to junk, deletion or quarantine.
- ✗
EmailPostDeliveryEvents and EmailUrlInfo
Why it's wrong here
EmailUrlInfo holds URL metadata for messages, not the delivery or post-delivery remediation records the analyst needs. It is tempting because URL data supports investigating malicious links, but pairing it with EmailPostDeliveryEvents omits the original message metadata held in EmailEvents.
- ✗
EmailEvents and CloudAppEvents
Why it's wrong here
CloudAppEvents records user and admin activity across Microsoft 365 apps and services, not mail-flow or ZAP remediation. It tempts analysts investigating suspicious cloud activity alongside email, but ZAP actions are recorded in EmailPostDeliveryEvents; CloudAppEvents contains no post-delivery purge records, so the remediation timeline cannot be reconstructed.
Go deeper
Related to this question
About these practice questions
One of 1,303 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.