The answer is the EmailEvents table. This is correct because EmailEvents in Microsoft Defender XDR Advanced Hunting captures every email delivery event across the organization, including sender, recipient, subject, and delivery status, making it the precise table to query when you need to find all instances of a specific email—identified by its NetworkMessageId—that was delivered to other users. On the SC-200 exam, this question tests your ability to map investigative goals to the correct Advanced Hunting schema; a common trap is confusing EmailEvents with EmailAttachmentInfo (which stores attachment metadata but not delivery events) or EmailPostDeliveryEvents (which tracks actions after delivery). Remember that delivery events are the core of EmailEvents, so if the scenario asks where an email was sent or delivered, start here. A helpful memory tip: think of EmailEvents as the “shipping log” for every email that landed in a mailbox.
SC-200 Mitigate threats using Microsoft Defender XDR Practice Question
This SC-200 practice question tests your understanding of mitigate threats using microsoft defender xdr. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security analyst is investigating a suspicious email that was reported by a user. The email contains an attachment with a known malicious macro. The analyst wants to find all instances of this same email being delivered to other users in the organization. Which Advanced Hunting table should the analyst query to find the delivery events?
Why wrong: This table provides details about email attachments but does not indicate which users received the email. It must be joined with EmailEvents.
B
EmailEvents
Correct. EmailEvents contains the delivery records, including the recipient addresses and delivery status. It can be filtered or joined with attachment data to find all recipients.
C
EmailUrlInfo
Why wrong: This table stores URL information in emails, not attachment delivery events.
D
DeviceFileEvents
Why wrong: This table tracks file events on endpoints (not email delivery) and would only show if the attachment was opened on a device.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
EmailEvents
The EmailEvents table in Microsoft Defender XDR Advanced Hunting contains records of email delivery events, including sender, recipient, subject, and delivery status. Since the analyst needs to find all instances where the same email (with the malicious macro attachment) was delivered to other users, querying EmailEvents with the email's unique identifier (e.g., NetworkMessageId) will return all delivery events across the organization.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
EmailAttachmentInfo
Why it's wrong here
This table provides details about email attachments but does not indicate which users received the email. It must be joined with EmailEvents.
✓
EmailEvents
Why this is correct
Correct. EmailEvents contains the delivery records, including the recipient addresses and delivery status. It can be filtered or joined with attachment data to find all recipients.
Related concept
Read the scenario before looking for a memorised answer.
✗
EmailUrlInfo
Why it's wrong here
This table stores URL information in emails, not attachment delivery events.
✗
DeviceFileEvents
Why it's wrong here
This table tracks file events on endpoints (not email delivery) and would only show if the attachment was opened on a device.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse EmailAttachmentInfo (which contains attachment hashes) with EmailEvents, assuming attachment data alone can identify all recipients, but only EmailEvents holds the delivery event records needed to find every user who received the email.
Trap categories for this question
Command / output trap
This table tracks file events on endpoints (not email delivery) and would only show if the attachment was opened on a device.
Detailed technical explanation
How to think about this question
Under the hood, EmailEvents uses the NetworkMessageId as a primary key to group all delivery attempts for a single email; querying `EmailEvents | where NetworkMessageId == '<ID>'` returns every recipient and their delivery status (e.g., Delivered, Failed, Filtered). A subtle behavior is that the same email may have multiple rows if it was sent to distribution groups, as each group member gets a separate event with the same NetworkMessageId but different RecipientObjectId.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SC-200 question in full detail.
Mitigate threats using Microsoft Defender XDR — This question tests Mitigate threats using Microsoft Defender XDR — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: EmailEvents — The EmailEvents table in Microsoft Defender XDR Advanced Hunting contains records of email delivery events, including sender, recipient, subject, and delivery status. Since the analyst needs to find all instances where the same email (with the malicious macro attachment) was delivered to other users, querying EmailEvents with the email's unique identifier (e.g., NetworkMessageId) will return all delivery events across the organization.
What should I do if I get this SC-200 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst is investigating a phishing incident and needs to find the specific email message that was delivered to a user. The analyst knows the subject line and the sender domain. Which advanced hunting table should the analyst query?
medium
✓ A.EmailEvents
B.EmailAttachmentInfo
C.EmailUrlInfo
D.EmailPostDeliveryEvents
Why A: The EmailEvents table in Microsoft Defender XDR's advanced hunting schema contains the core properties of email messages, including subject line, sender domain, recipient details, and delivery status. Since the analyst needs to find a specific email by subject and sender domain, this table is the correct starting point for querying delivered messages.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.