hardMultiple ChoiceObjective-mapped
SC-200 Practice Question: An analyst is investigating a data exfiltration…
An analyst is investigating a data exfiltration incident. They suspect that a user downloaded sensitive files from a SharePoint site and then uploaded them to a non-corporate cloud storage service (e.g., Dropbox) using the same device. Which combination of Advanced Hunting tables should the analyst query to correlate the SharePoint download activity with network connections to external IPs?
⚠ Common exam trap
The trap here is that candidates often pick DeviceFileEvents (Option C) thinking it logs the SharePoint download locally, but SharePoint downloads are cloud events logged in CloudAppEvents, not local file events.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CloudAppEvents and DeviceNetworkEvents
CloudAppEvents logs user activities in cloud apps like SharePoint, including file downloads. DeviceNetworkEvents logs network connections from devices, including connections to external IPs. Combining these tables allows the analyst to correlate the SharePoint download event (from CloudAppEvents) with subsequent network connections to non-corporate cloud storage IPs (from DeviceNetworkEvents) on the same device, directly mapping the exfiltration path.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
CloudAppEvents and DeviceNetworkEvents
Why this is correct
CloudAppEvents is the authoritative cloud-side audit source for SharePoint and OneDrive activity, recording file download events with user, file, and timestamp; DeviceNetworkEvents supplies endpoint-level outbound connection details such as destination IP, port, and protocol. Joining these two tables on the device ID and a narrow time window lets the analyst correlate the SharePoint fetch to the subsequent network egress, proving both the data source and the exfiltration path.
- ✗
EmailEvents and DeviceNetworkEvents
Why it's wrong here
EmailEvents captures mail flow, phishing verdicts, and delivery status, but it has no visibility into SharePoint document downloads or any other cloud-app activity. Even with DeviceNetworkEvents revealing outbound connections, you are left correlating an unknown cloud action to a network flow, so the provenance of the stolen file remains unproven. The investigation needs CloudAppEvents to identify the actual download event before the network transfer is meaningful.
- ✗
DeviceFileEvents and DeviceNetworkEvents
Why it's wrong here
DeviceFileEvents logs local file-system operations such as file creation, modification, or deletion on the endpoint, but a SharePoint download delivered via HTTP is not represented as a distinct file-creation event with a source attribute of 'SharePoint' — the browser/client typically writes cache or temp files, which are ambiguous. Pairing it with DeviceNetworkEvents only demonstrates that local file activity happened near a network connection, which is too weak a correlation to attribute to a specific cloud download. The cloud-side event in CloudAppEvents is the definitive record that the file came from SharePoint.
- ✗
CloudAppEvents and IdentityLogonEvents
Why it's wrong here
IdentityLogonEvents records authentication outcomes, MFA prompts, and sign-in session data, so it can establish who logged in and when, but it contains no information about outbound network connections to external IP addresses. Combining it with CloudAppEvents would show that a user downloaded a file from SharePoint and authenticated, yet it would leave the actual data-transfer leg unseen — you still would not know where the data was sent. DeviceNetworkEvents is required to observe the endpoint's socket-level connection to the exfiltration destination.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.