On this page
Intro
SC-200, Microsoft Security Operations Analyst, supports the Microsoft Certified: Security Operations Analyst Associate credential. Microsoft describes the candidate as a security operations analyst who reduces organizational risk by triaging alerts, responding to incidents, hunting for threats and engineering detections. CertMonk can help organize review alongside hands-on work in a test tenant. The audience description comes from Microsoft’s certification page.
The exam centers on Microsoft Defender XDR, Microsoft Sentinel and the Kusto Query Language (KQL). If you have never written a query or opened an incident queue, plan extra time for those foundations before you start the domain-level material below.
Exam at a glance
| Detail | SC-200 |
|---|---|
| Exam code | SC-200 |
| Questions | Exact count not published on the reviewed pages; Microsoft says question numbers vary by exam |
| Time | 100 minutes, as listed on the certification page |
| Passing score | 700 or greater on a 1–1,000 scale |
| Question types | Proctored exam; interactive components may appear |
| Price | Check the vendor’s site for current pricing |
| Retirement | Date not published on the reviewed pages |
Sources: SC-200 certification page, exam experience and scoring policy, reviewed November 7, 2026.
Version update. Microsoft’s study guide lists skills measured as of October 21, 2026. Its change log marks the data ingestion area as a minor change and the other areas as unchanged in the portion reviewed. Check the date on any course or book against the current study guide before you rely on it.
Exam domains and weights
| Domain | Weight | In plain English |
|---|---|---|
| Manage a security operations environment | 40–45% | Set up automation, Sentinel, data ingestion and detections. |
| Respond to security incidents | 35–40% | Investigate and remediate alerts across Defender and Microsoft 365. |
| Perform threat hunting | 20–25% | Use KQL and hunting tools to find threats proactively. |
Microsoft publishes ranges, so keep them as ranges when planning your time. The largest domain is also the most configuration-heavy, which makes hands-on practice especially valuable. Use the skills measured list as your checklist.
What each domain really tests
Manage a security operations environment
This domain groups four areas: automation for Defender XDR and Sentinel, the Sentinel platform itself, data ingestion and detections. Treat them as one pipeline. Data has to arrive before a rule can fire, and a rule has to fire before an automation can respond.
For ingestion, practice choosing a connector from the data source requirement rather than from the product name. Windows security events, Syslog, Common Event Format and Azure activity logs each have their own collection route. For every route, write down where the data lands and how you would confirm it arrived.
For detections, compare custom detection rules in Defender XDR with analytics rules in Sentinel. Note which rule types exist (scheduled, near-real-time, threat intelligence and machine learning) and what each is suited to. Then connect detections to automation rules and playbooks, and explain what happens to an incident after the rule fires.
Platform topics such as roles, data retention tiers, workbooks and optimization recommendations reward careful reading. Ask who needs access, how long data must be kept and at what cost, then confirm your answer against the documentation.
Respond to security incidents
This domain is about judgment under a queue of alerts. Study each Defender product by the signals it produces: endpoint, email and collaboration, identity, cloud workloads and cloud apps. For each, write the first three things you would check and the remediation actions available.
Practice following a multi-stage attack across products. The outline calls out complex attacks such as lateral movement, so build a habit of asking how an alert on one entity connects to an alert on another. Incident case management belongs here too: ownership, status and documentation.
For Defender for Endpoint, rehearse reading a device timeline, taking device actions such as live response, collecting an investigation package and interpreting automatic attack disruption. For Microsoft 365 activity, learn what Purview Audit, content search and Graph activity logs can each show you and where they fall short.
The current outline also includes investigating incidents with agentic AI, including embedded Security Copilot. Give that its own notes: what the assistant summarizes, what you still verify yourself and why.
Perform threat hunting
Hunting is mostly KQL. Spend regular short sessions writing queries rather than reading about them. Start by choosing the right table for a question, then filter, summarize and join. Explain each query in a sentence before you run it.
In Defender XDR, study Advanced Hunting, threat analytics and hunting graphs. In Sentinel, study hunting queries, KQL jobs in the data lake, summary rule tables and notebooks. For each tool, note when it is a better fit than the others.
A useful habit is to write the hypothesis first: what behavior would indicate a threat, which table records it and what a false positive would look like. This turns query practice into reasoning practice.
The topics above follow Microsoft’s SC-200 outline; the study methods are our learning approach.
A realistic six-week study plan
This plan assumes some familiarity with Microsoft 365 or Azure administration. It is a suggested schedule, not a promise about readiness. If early weeks show gaps in fundamentals, extend the schedule.
Week 1: orient and start KQL
Read the full outline once and mark unfamiliar products. Set up a test tenant or guided lab environment if you can. Begin short daily KQL sessions that you will continue for the whole plan.
End the week by explaining the difference between Defender XDR and Sentinel in your own words, and where each stores data.
Week 2: data ingestion and platform setup
Work through connectors, collection rules, custom tables, roles and retention. For every data source, write how it is collected and how you would verify it.
Add untimed practice questions at the end of the week and note the reasoning behind every uncertain choice.
Week 3: detections and automation
Study custom detection rules, analytics rule types, anomaly settings and the MITRE ATT&CK coverage view. Then connect them to automation rules and playbooks.
Leave one session open for catch-up. If a topic keeps confusing you, repair it with a small exercise instead of a large one.
Week 4: incident response in Defender XDR
Cover alerts and incidents across email, identity, cloud workloads and cloud apps. Practice tracing a story across products, from the first alert to the final remediation.
Write a short incident summary for each exercise: what happened, what evidence you saw, what you did and how you verified it.
Week 5: endpoint response, Microsoft 365 investigation and hunting
Study device timelines, live response, investigation packages, Purview Audit, content search and Graph activity logs. Then move into hunting with Advanced Hunting and Sentinel tools.
Use mixed practice to find weak links between topics, and follow up with targeted reading instead of repeating comfortable areas.
Week 6: review under time pressure
Add timed practice and inspect your reasoning afterward. Separate rushed reading from missing knowledge. Spend remaining sessions on recurring gaps, and review Microsoft’s exam-experience page.
Make a deliberate readiness decision. Finishing six weeks is an organizational milestone, not proof of competence.
Common mistakes and how to avoid them
- Skipping KQL practice. Write queries often; reading examples is not the same as composing them.
- Studying products in isolation. Incidents cross products, so practice following entities between them.
- Treating the Sentinel platform as a footnote. The first domain carries the largest weight.
- Memorizing portal screens. Interfaces change. Learn the purpose of each setting and how to verify it.
- Using an outdated outline. The skills measured were updated in October 2026, so compare any older material against the current guide.
- Rushing into timed practice. Build clear reasoning untimed first, then use the clock to check pacing.
How to use practice questions well
After each practice item, explain why the chosen answer fits and why each alternative does not. Review wrong-answer explanations for the assumption that led you astray, and add that concept to your next study session.
CertMonk includes explanations for every answer choice, randomized practice tests, timed and untimed modes, flip-card flashcards, study games and progress by exam domain. Use the domain view to choose follow-up work, and use flashcards for short review between lab sessions.
Keep a separate list of correct guesses and revisit them later without the answer choices in front of you. When you add timed practice, treat the result as feedback on your preparation rather than a prediction of an exam outcome.
Free practice questions
Use the free SC-200 samples below to explore the explanations and spot areas to review without a purchase.
A compliance officer asks for the maximum retention Microsoft Sentinel supports in the analytics tier and in total, including the data lake. Which answer is correct?
- AUp to 30 days in the analytics tier and unlimited total retention.
- BUp to 2 years in the analytics tier and up to 12 years of total retention.
- CUp to 12 years in the analytics tier and up to 2 years of total lake retention.
- DUp to 90 days in the analytics tier and up to 7 years of total retention.
Show the answer and explanation
Answer: B. Up to 2 years in the analytics tier and up to 12 years of total retention.
Correct. Analytics retention extends to two years at a prorated charge, and total retention in the lake extends to 12 years.
Why not the others
- A. Thirty days is the Defender XDR default, and total retention has a 12-year limit.
- C. This reverses the two limits; total retention cannot be shorter than analytics retention.
- D. Ninety days is the free Sentinel retention for solution tables, not the maximum, and total retention goes beyond seven years.
Takeaway: Sentinel retention limits: analytics tier up to two years, total retention (mirrored to the lake) up to 12 years.
Source: Manage data tiers and retention in Microsoft Sentinel
An incident tagged Attack Disruption shows that a finance user was contained automatically. The investigation is complete, the user’s device has been cleaned, and the password reset. How should the analyst restore the user’s access?
- AUndo the Contain user action.
- BCreate a new account for the user.
- CWait: contained users are released automatically after 24 hours.
- DExclude the user from all Conditional Access policies.
Show the answer and explanation
Answer: A. Undo the Contain user action.
Correct. Attack disruption actions are reversible; analysts release contained users and devices after remediation.
Why not the others
- B. Unnecessary; the containment can be undone.
- C. Releasing contained users is an analyst action; do not rely on waiting.
- D. Conditional Access has nothing to do with the containment.
Takeaway: Attack disruption leaves the SOC in control: after remediation, release contained users or devices from the incident or the Action center.
Source: Details and results of an automatic attack disruption action
After a phishing compromise, a hunter wants to see whether the victim’s workstation ran LDAP queries against domain controllers to enumerate Domain Admins group membership. Which table records this activity?
- AIdentityQueryEvents
- BIdentityLogonEvents
- CIdentityDirectoryEvents
- DDeviceNetworkEvents on port 389 only
Show the answer and explanation
Answer: A. IdentityQueryEvents
Correct. IdentityQueryEvents records queries against Active Directory objects, such as LDAP and DNS queries seen by Defender for Identity.
Why not the others
- B. That table records authentications, not directory queries.
- C. That table records changes to directory objects, not read queries.
- D. Connections on port 389 show that LDAP traffic occurred, not which objects were queried.
Takeaway: Directory reconnaissance appears in IdentityQueryEvents; directory changes appear in IdentityDirectoryEvents.
Source: IdentityQueryEvents table in the advanced hunting schema
After an incident at a partner company, the SOC receives a one-off CSV file with 400 IP addresses, domains, and file hashes to import into Microsoft Sentinel threat intelligence today. No platform or feed is involved. What is the simplest supported method?
- AUse the threat intelligence bulk import from a CSV or JSON file.
- BUpload the CSV as a watchlist, which Sentinel treats as threat indicators.
- CConfigure the Threat Intelligence – TAXII connector pointed at the CSV file.
- DBuild an app that calls the upload API once for each indicator.
Show the answer and explanation
Answer: A. Use the threat intelligence bulk import from a CSV or JSON file.
Correct. Sentinel can add indicators in bulk from a CSV or JSON file for one-off imports.
Why not the others
- B. Watchlists are reference data, not threat indicator objects.
- C. TAXII connects to a TAXII server, not to a file.
- D. The API suits platforms that integrate continuously; a one-off file import is simpler.
Takeaway: Match the TI ingestion method to the source: bulk file import for one-off lists, TAXII for TAXII servers, the upload API for integrated threat intelligence platforms.
Source: Add indicators in bulk to Microsoft Sentinel threat intelligence from a CSV or JSON file
A managed security provider triages cases for 20 customer tenants from the Microsoft Defender multitenant portal. An analyst sees cases from only 14 tenants. What is the MOST likely reason?
- AThe multitenant portal shows at most 14 tenants.
- BCases appear only for tenants using Sentinel in the Azure portal.
- CRBAC is applied per tenant.
- DThe other six tenants have no incidents, which hides them entirely.
Show the answer and explanation
Answer: C. RBAC is applied per tenant.
Correct. In the multitenant cases list, RBAC is applied at the tenant level.
Why not the others
- A. There is no such fixed display limit.
- B. The multitenant portal is part of the Defender portal experience.
- D. Tenants without cases would simply show none; the more likely cause is access.
Takeaway: Multitenant case views respect each tenant’s RBAC; missing tenants usually mean missing access, not missing features.
Source: View and manage cases across multiple tenants in the Microsoft Defender multitenant portal
FAQ
Which certification does SC-200 support?
It supports Microsoft Certified: Security Operations Analyst Associate, as shown on Microsoft’s certification page.
How long is the SC-200 exam?
Microsoft’s certification page lists 100 minutes. Interactive components may appear, so review the exam experience page before test day.
Do I need to know KQL?
Yes. Threat hunting is a published domain, and KQL appears throughout the outline, including table selection and hunting queries. Practice writing queries, not only reading them.
What score do I need?
Microsoft states that a score of 700 or greater is required on its 1–1,000 scale, as described in its scoring policy.
How long should I study?
Use six weeks as a starting framework if you already work with Microsoft security tools. Add time where your notes show gaps; no single schedule suits everyone.
Can an older course cover everything?
Check it topic by topic against the current skills measured. Use the relevant parts, then fill uncovered areas with current Microsoft documentation.
Next step
Try free practice questions → https://app.certmonk.app/samples
