mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: A security analyst wants to identify all users…
A security analyst wants to identify all users who received a phishing email that contained a known malicious URL. The analyst has the URL. Which advanced hunting table should the analyst query first to find the emails that contained this URL?
⚠ Common exam trap
The trap here is that candidates often jump to EmailEvents thinking it contains all email details, but they forget that URL content is stored in a separate table (EmailUrlInfo) and must be queried first to identify the specific emails.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
EmailUrlInfo
The EmailUrlInfo table in Microsoft Defender XDR contains records of URLs extracted from email messages, including the specific URL and the email's unique identifier (NetworkMessageId). By querying this table for the known malicious URL, the analyst can retrieve the NetworkMessageIds of all emails containing that URL, which can then be joined with the EmailEvents table to identify the recipients. This is the most direct and efficient first step because EmailUrlInfo is purpose-built to map URLs to email messages.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
EmailEvents
Why it's wrong here
EmailEvents contains the core metadata of an email message, such as the sender, recipient, subject, and delivery disposition, but it does not store the individual URLs that appear in the message body or attachments. Therefore, querying EmailEvents for a specific malicious URL will return no results because that information is simply not part of this table's schema. To identify emails containing a URL, you must pivot from EmailUrlInfo to EmailEvents using the NetworkMessageId as the join key.
- ✓
EmailUrlInfo
Why this is correct
EmailUrlInfo is the correct table because it is specifically designed to store each URL extracted from an email, along with the corresponding NetworkMessageId. By filtering EmailUrlInfo on the known malicious URL, you obtain the NetworkMessageId(s) of all emails that contained that link, which can then be joined to EmailEvents to retrieve the recipient list. This table is the authoritative source for URL-to-email correlations in Advanced Hunting.
- ✗
EmailAttachmentInfo
Why it's wrong here
EmailAttachmentInfo stores metadata about email attachments, such as the filename, file size, and SHA-256 hash, but it does not contain any information about URLs found in the email body. Even though an attacker might send a malicious link, that link is not an attachment, so it will never be captured in EmailAttachmentInfo. This table is useful for hunting on malicious files, not malicious URLs.
- ✗
EmailPostDeliveryEvents
Why it's wrong here
EmailPostDeliveryEvents logs actions that occur after an email has been delivered, such as spam filtering, phishing verdicts, or user-reported messages, but it does not contain the original email content or its URLs. You cannot use this table to search for emails that contained a specific URL because the URL data is not part of the post-delivery event schema. It would only be useful if you already have the NetworkMessageId and need to understand the post-delivery handling of that message.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 209-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.