SC-200 Mitigate threats using Microsoft Defender XDR Practice Question
This SC-200 practice question tests your understanding of mitigate threats using microsoft defender xdr. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. A key principle to apply: emailEvents table records initial email delivery decisions.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security analyst is reviewing phishing emails in Microsoft 365 Defender and wants to identify all messages that were blocked by an anti-phish policy before delivery. The analyst plans to use advanced hunting. Which table column indicates whether an email was blocked as phishing?
Correct. The EmailEvents table records the delivery action (Delivered, Blocked, Junked) determined by policies like anti-phish policies.
B
EmailPostDeliveryEvents table, the 'Action' column
Why wrong: Incorrect. The Action in EmailPostDeliveryEvents indicates post-delivery actions (e.g., user moved to junk, admin removed from quarantine), not the initial block.
C
EmailAttachmentInfo table, the 'FileType' column
Why wrong: Incorrect. EmailAttachmentInfo stores attachment metadata but does not contain delivery decision information.
D
EmailUrlInfo table, the 'Url' column
Why wrong: Incorrect. EmailUrlInfo contains URLs found in emails but not delivery actions.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
EmailEvents table, the 'DeliveryAction' column
The EmailEvents table records actions taken on emails before delivery, including whether a message was blocked by anti-phish policies. The 'DeliveryAction' column specifically indicates the final disposition, such as 'Blocked' for phishing. This makes it the correct source for identifying pre-delivery phishing blocks in advanced hunting.
Key principle: EmailEvents table records initial email delivery decisions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
EmailEvents table, the 'DeliveryAction' column
Why this is correct
Correct. The EmailEvents table records the delivery action (Delivered, Blocked, Junked) determined by policies like anti-phish policies.
Related concept
EmailEvents table records initial email delivery decisions.
✗
EmailPostDeliveryEvents table, the 'Action' column
Why it's wrong here
Incorrect. The Action in EmailPostDeliveryEvents indicates post-delivery actions (e.g., user moved to junk, admin removed from quarantine), not the initial block.
✗
EmailAttachmentInfo table, the 'FileType' column
Why it's wrong here
Incorrect. EmailAttachmentInfo stores attachment metadata but does not contain delivery decision information.
✗
EmailUrlInfo table, the 'Url' column
Why it's wrong here
Incorrect. EmailUrlInfo contains URLs found in emails but not delivery actions.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse the EmailPostDeliveryEvents table (which shows post-delivery remediation actions like 'Move to Junk' or 'Soft Delete') with pre-delivery blocking, but the correct table for pre-delivery phishing blocks is EmailEvents with the 'DeliveryAction' column.
Detailed technical explanation
How to think about this question
The EmailEvents table's 'DeliveryAction' column uses values like 'Blocked', 'Delivered', or 'Junked' to indicate the final verdict from anti-phish policies. When a phishing email is blocked before delivery, the 'DetectionMethod' column in the same table often shows 'Anti-phish' or 'Anti-spam' as the detection technology. This allows analysts to correlate specific policy actions with threat types in advanced hunting queries.
KKey Concepts to Remember
EmailEvents table records initial email delivery decisions.
The 'DeliveryAction' column indicates the final pre-delivery outcome (e.g., Blocked, Delivered).
Anti-phish policies operate pre-delivery, influencing the 'DeliveryAction'.
Advanced hunting uses KQL to query these tables for security investigations.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
EmailEvents table records initial email delivery decisions.
Real-world example
How this comes up in practice
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. EmailEvents table records initial email delivery decisions. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SC-200 question in full detail.
Mitigate threats using Microsoft Defender XDR — This question tests Mitigate threats using Microsoft Defender XDR — EmailEvents table records initial email delivery decisions..
What is the correct answer to this question?
The correct answer is: EmailEvents table, the 'DeliveryAction' column — The EmailEvents table records actions taken on emails before delivery, including whether a message was blocked by anti-phish policies. The 'DeliveryAction' column specifically indicates the final disposition, such as 'Blocked' for phishing. This makes it the correct source for identifying pre-delivery phishing blocks in advanced hunting.
What should I do if I get this SC-200 question wrong?
Review emailEvents table records initial email delivery decisions., then practise related SC-200 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
EmailEvents table records initial email delivery decisions.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.