easyMultiple ChoiceObjective-mapped
SC-200 Practice Question: Receiving a suspicious email that bypassed the…
A user reports receiving a suspicious email that bypassed the spam filter. An analyst opens the Microsoft 365 Defender portal to investigate. Which component provides a detailed entity view of the email including delivery actions, phish simulation details, and campaign information?
⚠ Common exam trap
A common mix-up: candidates confuse Microsoft Defender for Office 365's Threat Explorer with Microsoft Defender for Endpoint's advanced hunting, but only Threat Explorer provides the specific email entity view with delivery actions, phish simulation flags, and campaign metadata required for this investigation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Office 365 (Threat Explorer)
Microsoft Defender for Office 365's Threat Explorer (now part of the unified investigation experience) provides a detailed entity view of an email, including delivery actions (e.g., delivered to Junk, blocked, or allowed), whether the email was part of a phishing simulation, and the associated campaign information. This tool is specifically designed for deep email threat investigation within the Defender for Office 365 portal, leveraging telemetry from Exchange Online Protection (EOP) and Defender for Office 365.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Microsoft Defender for Endpoint is an endpoint detection and response (EDR) solution that monitors devices for malicious activities, vulnerabilities, and behavioral anomalies. It cannot inspect email transport data, mailbox content, or the message-level properties that indicate why a message bypassed a spam filter. While it may alert on malware that executes on a device after arrival via email, it lacks the email entity context needed for this investigation, making it the wrong tool here.
- ✓
Microsoft Defender for Office 365 (Threat Explorer)
Why this is correct
Microsoft Defender for Office 365 Threat Explorer is the correct tool because it provides a granular email-focused entity view that includes delivery actions, threat types, phish simulation tags, and associated campaign information for messages that bypassed filtering. Analysts can pivot from a single email ID to see message traces, sender and recipient details, and the specific policy or isolation verdict applied. This investigative capability directly addresses the need to examine a suspicious email received despite the existing spam filter.
- ✗
Microsoft Defender for Identity
Why it's wrong here
Microsoft Defender for Identity (MDI) focuses on detecting identity-based attacks such as compromised accounts, lateral movement, and privilege escalation within on-premises Active Directory environments. It does not analyze email headers, message bodies, transport rules, or mailbox-level delivery details. Although MDI might flag anomalous sign-ins after a user interacts with a phishing email, it cannot trace the email's origin, delivery path, or campaign association, so it is unsuited for this email investigation.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that provides visibility into cloud application usage, enforces conditional access policies, and controls data sharing across SaaS and PaaS environments. It retrieves audit logs for applications like Exchange Online but does not offer a message-level mailbox view with email-specific properties such as anti-spam verdicts, sender spoofing indicators, or threat categorization. Therefore, it cannot be used to investigate why a particular email bypassed the spam filter.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.