mediumMultiple Choice
SC-200 Practice Question: A security analyst is investigating a potential…
A security analyst is investigating a potential business email compromise (BEC) campaign. The analyst wants to find all emails that were sent to external recipients from an internal user's mailbox that also had a login from an unusual location shortly after the email was sent. Which advanced hunting tables should the analyst query to get the email metadata and the sign-in details?
⚠ Common exam trap
A common mix-up: candidates confuse DeviceLogonEvents or IdentityLogonEvents with Microsoft Entra ID sign-in logs, not realizing that AADSignInEventsBeta is the only table that captures cloud-based sign-in location data for Microsoft 365 services like Exchange Online.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
EmailEvents and AADSignInEventsBeta
EmailEvents stores email metadata (sender, recipient, subject, etc.) and AADSignInEventsBeta captures Microsoft Entra ID sign-in logs, including location data. Joining these tables on the user's account object ID allows the analyst to correlate emails sent to external recipients with unusual sign-in locations shortly after the email was sent, directly addressing the BEC investigation scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
EmailEvents and AADSignInEventsBeta
Why this is correct
EmailEvents is the correct source for the send side of a business email compromise because it records the sender's SMTP address, recipient, subject, and send timestamp for every outbound message. AADSignInEventsBeta is equally essential for the sign-in side, capturing interactive and non-interactive authentication events against Microsoft Entra ID with fields like UserPrincipalName, IP address, and risk level. Joining on the sender's SMTP address to the sign-in UPN lets you correlate an anomalous sign-in with a suspicious email sent by that account, which directly ties the initial phish to attacker authentication.
- ✗
EmailPostDeliveryEvents and DeviceLogonEvents
Why it's wrong here
EmailPostDeliveryEvents is the wrong counterpart because it only tracks actions that occur after an email is delivered, such as user clicks, forwards, or deletion, and it contains no sender identity or transmit metadata. DeviceLogonEvents, meanwhile, logs local interactive and remote logons to Windows endpoints using the Defender for Endpoint sensor, not Microsoft Entra ID cloud authentication. Therefore, this pair could show you that a recipient clicked a link and then logged into a workstation, but it will not reveal who sent the phishing email or expose an attacker's cloud sign-in.
- ✗
EmailAttachmentInfo and IdentityLogonEvents
Why it's wrong here
EmailAttachmentInfo is limited to enumerating attachment filenames, hashes, and sizes from email messages, so it lacks the sender and recipient data needed to identify the source of a malicious send. IdentityLogonEvents is produced by Microsoft Defender for Identity and represents on-premises Active Directory authentication attempts via NTLM or Kerberos, not Microsoft Entra ID sign-in logs. This combination would at best let you attribute a suspicious attachment to a particular mailbox while seeing only on-premises auth, leaving the cloud sign-in correlation completely unanswered.
- ✗
EmailUrlInfo and CloudAppEvents
Why it's wrong here
EmailUrlInfo captures only the URLs embedded in email bodies and metadata like URL chain, verdict, and click status; it does not record sender identity or message routing information for the send. CloudAppEvents is an aggregated activity log for Microsoft 365 and third-party cloud applications, such as file downloads or permission changes, but it does not enumerate Microsoft Entra ID sign-in events like those found in AADSignInEventsBeta. Thus, this pair would inform you about URL reputation and app usage but cannot connect an individual sender's email to a subsequent authentication event.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.