The answer is joining EmailEvents and EmailAttachmentInfo on NetworkMessageId. This is correct because the custom detection for same attachment name multiple times requires correlating email-level metadata—such as recipient and timestamp—with attachment details like file name. EmailEvents provides the delivery context, while EmailAttachmentInfo supplies the attachment-specific data; linking them via NetworkMessageId allows you to count how many times a user received the same attachment name within a one-hour window, flagging potential malware campaigns. On the SC-200 exam, this tests your ability to design advanced hunting queries using the Microsoft 365 Defender schema, and a common trap is confusing EmailAttachmentInfo with EmailUrlInfo or forgetting that NetworkMessageId is the shared key. To remember, think: “Events for the envelope, AttachmentInfo for the file—join on the message ID to profile the attack.”
SC-200 Mitigate threats using Microsoft Defender XDR Practice Question
This SC-200 practice question tests your understanding of mitigate threats using microsoft defender xdr. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security analyst wants to create a custom detection rule in Microsoft 365 Defender that alerts when a user receives more than 5 emails with the same attachment name within 1 hour, indicating a possible malware campaign. Which advanced hunting tables should be joined to achieve this detection?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Join EmailEvents and EmailAttachmentInfo on NetworkMessageId
To detect when a user receives more than 5 emails with the same attachment name within 1 hour, you need to correlate email metadata with attachment details. The EmailEvents table contains email-level information (e.g., recipient, timestamp), while the EmailAttachmentInfo table stores attachment-level data (e.g., file name). Joining these on NetworkMessageId allows you to count occurrences of the same attachment name per recipient within a time window, enabling the custom detection rule.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Join EmailEvents and EmailAttachmentInfo on NetworkMessageId
Why this is correct
This join allows counting emails per attachment name per user within a time window.
Related concept
Read the scenario before looking for a memorised answer.
✗
Join EmailEvents and EmailUrlInfo on NetworkMessageId
Why it's wrong here
URL info is not about attachment names; this would miss attachment data.
✗
Use only EmailAttachmentInfo table with a filter on file name
Why it's wrong here
The EmailAttachmentInfo table does not contain recipient information (email address), which is in EmailEvents.
✗
Join EmailEvents and DeviceFileEvents on SHA1 hash
Why it's wrong here
DeviceFileEvents are for file events on endpoints, not email attachments.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may think they need to join with endpoint file events (DeviceFileEvents) to detect malware, but the question specifically requires detecting the email receipt pattern, not post-delivery execution.
Detailed technical explanation
How to think about this question
The join on NetworkMessageId is a GUID that uniquely identifies an email message across all email-related tables in Advanced Hunting. When counting occurrences, you must use the `FileName` column from EmailAttachmentInfo and group by `RecipientEmailAddress` from EmailEvents, applying a `where Timestamp > ago(1h)` filter. A real-world scenario might involve a phishing campaign using a common attachment name like 'Invoice.pdf' sent to multiple users; this query would catch the threshold breach even if the attachment content differs.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SC-200 question in full detail.
Mitigate threats using Microsoft Defender XDR — This question tests Mitigate threats using Microsoft Defender XDR — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Join EmailEvents and EmailAttachmentInfo on NetworkMessageId — To detect when a user receives more than 5 emails with the same attachment name within 1 hour, you need to correlate email metadata with attachment details. The EmailEvents table contains email-level information (e.g., recipient, timestamp), while the EmailAttachmentInfo table stores attachment-level data (e.g., file name). Joining these on NetworkMessageId allows you to count occurrences of the same attachment name per recipient within a time window, enabling the custom detection rule.
What should I do if I get this SC-200 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.