easyMultiple ChoiceObjective-mapped
SC-200 Practice Question: A security analyst is investigating a phishing…
A security analyst is investigating a phishing incident in Microsoft 365 Defender. They need to view the original email's sender, delivery action, and any automated remediation steps taken. Which entity page should the analyst open?
⚠ Common exam trap
Candidates often confuse the User entity page with email investigation because user accounts are often involved in phishing, but the User entity page lacks the specific email message-level details (sender, delivery action, remediation) that only the Email entity page provides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Email entity page
The Email entity page in Microsoft 365 Defender (part of Microsoft Defender XDR) is specifically designed to provide a comprehensive view of an email message, including the original sender, delivery action (e.g., delivered, quarantined, blocked), and any automated remediation steps (e.g., zero-hour auto purge, soft delete). This page aggregates data from Exchange Online Protection (EOP) and Microsoft Defender for Office 365, making it the correct choice for investigating phishing incidents.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
User entity page
Why it's wrong here
The user entity page in Microsoft 365 Defender centralizes identity-centric telemetry such as sign-in logs, risky user flags, and alerts assigned to the account. For a phishing incident, however, it lacks the message-level forensics—like the original email headers, sender reputation, and the delivery action (allowed, blocked, or quarantined)—that are essential to analyzing how the phishing email entered the environment and what automated responses were taken.
- ✗
Device entity page
Why it's wrong here
The device entity page details a single endpoint's security posture, including running processes, network sockets, installed software, and correlated alerts from Microsoft Defender for Endpoint. Even if the phishing investigation later pivots to a compromised device, this page will not display the phishing email's subject, sender, recipient, or the mail flow metadata that determines why it was delivered. It is endpoint-focused and cannot substitute for the email-specific record that the email entity page provides.
- ✓
Email entity page
Why this is correct
The email entity page is the definitive source for email-related investigation in Microsoft 365 Defender, offering the full message envelope: sender and recipient addresses, message ID, subject, and the deliver action—such as delivered, blocked, or quarantined—along with any automated remediation steps, including zero-hour auto purge (ZAP) or soft deletion. Because a phishing incident centers on the email itself, this page directly exposes the evidence needed to trace the message's path and confirm the incident's scope, making it the correct choice for such investigations.
- ✗
IP entity page
Why it's wrong here
The IP entity page supplies network-layer context for a given address, including geolocation, associated alerts, and any threat intelligence links, but it contains no email content or delivery details. In a phishing scenario, you might consult this page after pivoting from a URL extraction to check the malicious host's reputation, yet it cannot reveal the email body, headers, or the exact remediation applied to the message. It serves only as auxiliary enrichment, not as the primary record of the phishing incident.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.