hardMultiple ChoiceObjective-mapped
SC-200 Practice Question: A security analyst is hunting for a targeted…
A security analyst is hunting for a targeted phishing attack in Microsoft 365 Defender. They have identified a phishing email delivered to a user and want to find all devices where the user clicked the link in the email, and any processes that were spawned from the browser on those devices. Which advanced hunting strategy is most effective to correlate the email, network, and process data?
⚠ Common exam trap
Candidates often choose Option A, mistakenly thinking that user logon events are a reliable proxy for link clicks, but logons do not indicate that the user actually clicked the URL or that any malicious process was spawned from the browser.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Query EmailUrlInfo for the URL, then DeviceNetworkEvents for devices that connected to that URL, then DeviceProcessEvents for processes on those devices that started shortly after the connection.
It directly correlates the malicious URL from the email (via EmailUrlInfo) with devices that connected to that URL (via DeviceNetworkEvents), then identifies any processes spawned on those devices shortly after the connection (via DeviceProcessEvents). This sequence maps the attack chain from email delivery to network connection to post-click process execution, which is exactly what the analyst needs to find devices where the link was clicked and any resulting processes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Query EmailEvents for the email, then DeviceLogonEvents for user logons, then DeviceProcessEvents for process creations after logon.
Why it's wrong here
This chain incorrectly assumes that clicking a phishing link requires a new interactive logon on the target device. In reality, the user is typically already authenticated, and the malicious process is spawned from the existing browser or email client without a corresponding DeviceLogonEvent. Relying on DeviceLogonEvents as an intermediate step will therefore miss the click-to-execute chain, and the process creation after logon may be unrelated to the email.
- ✓
Query EmailUrlInfo for the URL, then DeviceNetworkEvents for devices that connected to that URL, then DeviceProcessEvents for processes on those devices that started shortly after the connection.
Why this is correct
This is the correct hunting path because EmailUrlInfo directly reveals the malicious URL from the email, DeviceNetworkEvents captures the outbound connection made by the endpoint when the user clicks that URL, and DeviceProcessEvents can then be filtered by a short time window around that network event to identify the payload process. Joining these tables on device ID and timestamp gives a precise, evidence-backed chain from email to network connection to execution. This approach works for link-based phishing even when the user is already logged on and no new authentication event occurs.
- ✗
Query EmailAttachmentInfo, then DeviceFileEvents for files dropped.
Why it's wrong here
This approach only covers email attachments and completely overlooks URL-based phishing, which is the vector described in the question. Even if an attachment is present, DeviceFileEvents only shows files being written to disk; it does not reveal whether the attachment's content executed a process, and there is no correlation to the network connection needed to confirm a click. As a result, this chain would miss the primary attack scenario and lacks the telemetry to prove a link was followed.
- ✗
Query IdentityLogonEvents, then DeviceEvents from the device where the logon occurred.
Why it's wrong here
IdentityLogonEvents represent cloud identity events such as Azure AD sign-ins, not endpoint-level activity, so they cannot tell you which device connected to the phishing URL. Even if a logon occurred, that event is not a reliable precursor to clicking a link—many phishing attacks happen during an existing authenticated session. Additionally, DeviceEvents without a preceding network-connection event to the specific URL is far too broad and will not isolate the malicious process chain, making this approach both indirect and incomplete.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.