SC-200 Practice Question: A security analyst is investigating a potential…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  EmailEvents and AADSignInEventsBeta

  Why this is correct

  EmailEvents is the correct source for the send side of a business email compromise because it records the sender's SMTP address, recipient, subject, and send timestamp for every outbound message. AADSignInEventsBeta is equally essential for the sign-in side, capturing interactive and non-interactive authentication events against Microsoft Entra ID with fields like UserPrincipalName, IP address, and risk level. Joining on the sender's SMTP address to the sign-in UPN lets you correlate an anomalous sign-in with a suspicious email sent by that account, which directly ties the initial phish to attacker authentication.

• ✗

  EmailPostDeliveryEvents and DeviceLogonEvents

  Why it's wrong here

  EmailPostDeliveryEvents is the wrong counterpart because it only tracks actions that occur after an email is delivered, such as user clicks, forwards, or deletion, and it contains no sender identity or transmit metadata. DeviceLogonEvents, meanwhile, logs local interactive and remote logons to Windows endpoints using the Defender for Endpoint sensor, not Microsoft Entra ID cloud authentication. Therefore, this pair could show you that a recipient clicked a link and then logged into a workstation, but it will not reveal who sent the phishing email or expose an attacker's cloud sign-in.

• ✗

  EmailAttachmentInfo and IdentityLogonEvents

  Why it's wrong here

  EmailAttachmentInfo is limited to enumerating attachment filenames, hashes, and sizes from email messages, so it lacks the sender and recipient data needed to identify the source of a malicious send. IdentityLogonEvents is produced by Microsoft Defender for Identity and represents on-premises Active Directory authentication attempts via NTLM or Kerberos, not Microsoft Entra ID sign-in logs. This combination would at best let you attribute a suspicious attachment to a particular mailbox while seeing only on-premises auth, leaving the cloud sign-in correlation completely unanswered.

• ✗

  EmailUrlInfo and CloudAppEvents

  Why it's wrong here

  EmailUrlInfo captures only the URLs embedded in email bodies and metadata like URL chain, verdict, and click status; it does not record sender identity or message routing information for the send. CloudAppEvents is an aggregated activity log for Microsoft 365 and third-party cloud applications, such as file downloads or permission changes, but it does not enumerate Microsoft Entra ID sign-in events like those found in AADSignInEventsBeta. Thus, this pair would inform you about URL reputation and app usage but cannot connect an individual sender's email to a subsequent authentication event.