The answer is the Email timeline section on the email entity page. This is correct because the Email timeline provides a chronological, event-by-event view of the email’s full lifecycle within Microsoft 365 Defender, capturing every action from initial delivery and user clicks on a phishing link to post-detection remediation steps like soft delete or quarantine. For the SC-200 exam, this question tests your ability to navigate the email entity page during incident investigation, specifically distinguishing the Email timeline from other tabs like Details or Attachments. A common trap is confusing the Email timeline with the Email summary, which only shows static metadata rather than the dynamic sequence of events. Remember the memory tip: “Timeline tells the story” — if you need to see the order of actions, from click to cleanup, the timeline is your go-to section.
SC-200 Mitigate threats using Microsoft Defender XDR Practice Question
This SC-200 practice question tests your understanding of mitigate threats using microsoft defender xdr. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: the Email timeline shows a chronological list of all email-related events.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An organization uses Microsoft 365 Defender. A security analyst is reviewing an incident that involves a user who clicked a phishing link in an email. The analyst wants to see the email's full timeline, including delivery, click, and any follow-up actions. Which section of the email entity page provides this information?
Why wrong: Detection details show the detection technologies and verdicts for the email, but not the full sequence of events.
B
Email timeline
The Email timeline provides a chronological view of all actions and events associated with the email, including delivery, user clicks, and system responses.
C
Threat types
Why wrong: Threat types list the categories of threats detected (e.g., phishing, malware) but do not show a timeline of events.
D
Investigation graph
Why wrong: The Investigation graph visualizes relationships between entities during automated investigation, not a linear timeline of the email itself.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Email timeline
The Email timeline section on the email entity page in Microsoft 365 Defender provides a chronological view of the email's lifecycle, including delivery, user clicks on the phishing link, and subsequent remediation actions such as soft delete or quarantine. This directly meets the analyst's need to see the full sequence of events for the incident.
Key principle: The Email timeline shows a chronological list of all email-related events.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Detection details
Why it's wrong here
Detection details show the detection technologies and verdicts for the email, but not the full sequence of events.
✓
Email timeline
Why this is correct
The Email timeline provides a chronological view of all actions and events associated with the email, including delivery, user clicks, and system responses.
Related concept
The Email timeline shows a chronological list of all email-related events.
✗
Threat types
Why it's wrong here
Threat types list the categories of threats detected (e.g., phishing, malware) but do not show a timeline of events.
✗
Investigation graph
Why it's wrong here
The Investigation graph visualizes relationships between entities during automated investigation, not a linear timeline of the email itself.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse the Investigation graph (which shows entity relationships) with the Email timeline (which shows chronological events), leading them to select the graph option when they need a sequential log of actions.
Trap categories for this question
Command / output trap
Detection details show the detection technologies and verdicts for the email, but not the full sequence of events.
Detailed technical explanation
How to think about this question
The Email timeline leverages the Microsoft 365 Defender's unified audit log and threat protection data to reconstruct the email's journey from sender to recipient, including post-delivery events like user clicks on URLs (tracked via Safe Links) and automated remediation actions (e.g., Zero-Hour Auto Purge). This timeline is critical for incident response as it correlates the exact moment of user interaction with security policies, enabling precise attribution of compromise.
KKey Concepts to Remember
The Email timeline shows a chronological list of all email-related events.
It includes delivery, user actions (e.g., clicks, opens), and system actions.
It is found within the email entity page in Microsoft 365 Defender.
It helps analysts understand the full lifecycle and user interaction with an email.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
The Email timeline shows a chronological list of all email-related events.
Real-world example
How this comes up in practice
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. The Email timeline shows a chronological list of all email-related events. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SC-200 question in full detail.
Review the Email timeline shows a chronological list of all email-related events., then practise related SC-200 questions on the same topic to reinforce the concept.
Mitigate threats using Microsoft Defender XDR — This question tests Mitigate threats using Microsoft Defender XDR — The Email timeline shows a chronological list of all email-related events..
What is the correct answer to this question?
The correct answer is: Email timeline — The Email timeline section on the email entity page in Microsoft 365 Defender provides a chronological view of the email's lifecycle, including delivery, user clicks on the phishing link, and subsequent remediation actions such as soft delete or quarantine. This directly meets the analyst's need to see the full sequence of events for the incident.
What should I do if I get this SC-200 question wrong?
Review the Email timeline shows a chronological list of all email-related events., then practise related SC-200 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
The Email timeline shows a chronological list of all email-related events.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.