SC-200 Practice Question: A security analyst is reviewing phishing emails…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  EmailEvents table, the 'DeliveryAction' column

  Why this is correct

  The EmailEvents table in Microsoft 365 Defender (Threat Explorer) records the system-level disposition for each message during the mail flow pipeline, and the DeliveryAction column stores the final verdict (e.g., Delivered, Blocked, Junked) determined by Exchange Online Protection policies such as anti-phishing and anti-spam. Since the question specifically asks about the initial delivery decision for phishing emails, this column is the authoritative source for whether a message was blocked at the edge or reached the inbox. Other columns in EmailEvents (e.g., ThreatName, Policy) can further filter the results, making it the correct place to start.

• ✗

  EmailPostDeliveryEvents table, the 'Action' column

  Why it's wrong here

  The EmailPostDeliveryEvents table logs actions that occur after a message has already been processed and delivered, such as a user manually moving it to Junk, an admin removing it from quarantine, or a system-level Zero-Hour Auto Purge (ZAP) taking place. The Action column in this table reflects those remedial or user-initiated changes, not the original delivery verdict that anti-phishing policies assigned during mail flow. Therefore, it cannot be used to determine whether an email was initially blocked or delivered.

• ✗

  EmailAttachmentInfo table, the 'FileType' column

  Why it's wrong here

  The EmailAttachmentInfo table contains structural metadata about files attached to an email, including the FileType column (e.g., .docm, .ps1) along with file name, size, and SHA-256 hash. While a phishing investigation may rely on this table to identify malicious payloads and correlate attachment detections, it contains no fields that indicate whether the email was delivered or blocked at the gateway. The DeliveryAction decision is made by policy at the organization level, not by attachment characteristics alone.

• ✗

  EmailUrlInfo table, the 'Url' column

  Why it's wrong here

  The EmailUrlInfo table stores URLs extracted from email bodies and attachments, along with verdict information about whether those URLs are malicious, but it does not contain any record of the email's delivery outcome. The Url column simply shows the literal URL string, which is useful for pivoting to threats like credential-harvesting links, yet the presence of a URL does not tell you if the email was delivered to the user's mailbox or dropped by anti-phishing rules. Delivery status is tracked exclusively in the EmailEvents table's DeliveryAction field.

Go deeper

Related to this question