Microsoft 365 Defender Threat Explorer for Phishing Investigation
An analyst is investigating a phishing campaign that targeted multiple users. The analyst needs to identify if any users clicked a malicious link in the email. Which Microsoft Defender for Office 365 feature should be used?
Quick Answer
The answer is Threat Explorer, the correct Microsoft Defender for Office 365 feature for investigating a phishing campaign and identifying if users clicked a malicious link. Threat Explorer provides a comprehensive, historical view of email threats, including detailed URL click activity, allowing an analyst to see exactly which users clicked on a specific link and when. This is distinct from Safe Links, which offers real-time protection at the moment of click but does not retain historical click data for post-incident investigation. On the SC-200 exam, this question tests your ability to differentiate between detection, protection, and investigation tools; a common trap is confusing Safe Links’ protective function with Threat Explorer’s investigative capability. Remember the memory tip: “Explorer for history, Safe Links for protection” — if you need to look back at what users already clicked, you need Threat Explorer.
⚠ Common exam trap
Many exam-takers confuse the protection features (Safe Links and Safe Attachments) with the investigation tool (Threat Explorer), assuming that because Safe Links blocks malicious clicks, it also provides historical click reports, when in fact Threat Explorer is the dedicated hunting and investigation tool for analyzing user actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Threat Explorer
Threat Explorer (also known as Explorer) in Microsoft Defender for Office 365 provides a real-time, interactive view of threat data, including email delivery status and user actions such as clicks on malicious links. It allows analysts to filter by 'Click action' to identify users who clicked a URL that was determined to be malicious, making it the correct tool for this investigation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Safe Attachments
Why it's wrong here
Safe Attachments scans attachments, not links.
- ✓
Threat Explorer
Why this is correct
Threat Explorer provides URL click data.
- ✗
Attack Simulator
Why it's wrong here
Attack Simulator is for training, not investigation.
- ✗
Safe Links
Why it's wrong here
Safe Links provides real-time protection, not historical click data.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A SOC analyst is investigating a phishing campaign that targets Microsoft 365 users. The analyst needs to collect email message headers from multiple users' mailboxes. Which Microsoft 365 Defender action should the analyst use?
easy- A.Use Microsoft 365 Defender > Actions & submissions to view email headers.
- B.Use Microsoft 365 Defender > Threat hunters to search for email headers.
- C.Use Microsoft 365 Defender > Attack simulation training to collect headers.
- ✓ D.Use Microsoft 365 Defender > Email & collaboration > Explorer to query email headers.
Why D: Microsoft 365 Defender's Email & collaboration > Explorer (also known as Threat Explorer) is the dedicated tool for querying email message headers across multiple user mailboxes. It allows analysts to search for specific email messages by sender, recipient, subject, or other attributes, and then view the full internet message headers (RFC 5322) for forensic analysis. This is the standard workflow for investigating phishing campaigns in Microsoft 365 Defender.
Variation 2. A security operations center (SOC) analyst is investigating an incident involving a user who received a phishing email with a malicious macro. The analyst needs to determine if any other users received the same email. Which Microsoft 365 Defender feature should the analyst use?
medium- A.Advanced Hunting
- B.Alert queue filtering
- ✓ C.Threat Explorer (Investigation)
- D.Email entity page
Why C: Threat Explorer in Microsoft 365 Defender allows hunting for email messages by sender, subject, or other attributes. Advanced Hunting is for raw queries; Email entity page shows one email; Alert queue filters by alert not email.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.