Free study guide

Microsoft SC-200 Study Guide

Microsoft Security Operations Analyst SC-200

Microsoft Security Operations Analyst (SC-200) is the associate exam for people who defend an organisation using Microsoft Defender XDR, Microsoft Sentinel and Microsoft Defender for Cloud. It covers setting up and tuning the security operations environment, responding to incidents, and hunting for threats with KQL. It suits analysts who already know Azure, Microsoft 365 and the basics of security operations.

  • Exam code SC-200
  • Associate level
  • 3 exam domains

This guide is free, with no sign-up. It explains every Microsoft SC-200 exam topic in plain English, one chapter at a time. Read them in order or jump straight to the topic you need.

  • 3chapters
  • 17topics
  • 6diagrams and exhibits
  • 1 h 44 minfast track
Start with Manage a Security Operations Environment
  • Every topic follows the same simple pattern: what it is, how it works, common mistakes
  • Diagrams and real command output where a picture explains it best
  • Exam tips and worked subnetting and IPv6 practice, with answers

How the exam is weighted

Each domain is worth roughly this share of the exam. The exam provider publishes a range for each domain, so the bar marks the middle of it. Spend your study time in proportion, and select a domain to open its chapter.

Chapters

Open a chapter to see its topics and how long each takes.

1Manage a Security Operations Environment8 topics · 48 min fast trackDefender XDR automation, Sentinel configuration, data ingestion and detection rules.
  1. 1Defender XDR Notifications and Endpoint Settings6 min
  2. 2Automated Investigation, Attack Disruption and Device Groups6 min
  3. 3Sentinel Automation Rules and Playbooks6 min
  4. 4Sentinel Roles, Retention and Workbooks6 min
  5. 5Data Connectors and Windows, Syslog and CEF Collection6 min
  6. 6Azure Activity, Threat Indicators and Custom Tables6 min
  7. 7Custom Detection Rules in Defender XDR6 min
  8. 8Sentinel Analytics Rules, MITRE and Anomalies6 min
Read the chapter overview →
2Respond to Security Incidents5 topics · 30 min fast trackDefender XDR, Defender for Endpoint, identities, cloud, Sentinel and Microsoft 365 investigations.
  1. 1Responding in Defender XDR, Office 365 and Purview6 min
  2. 2Identities, Defender for Identity and Sentinel Incidents6 min
  3. 3Agentic AI, Complex Attacks and Case Management6 min
  4. 4Responding in Defender for Endpoint6 min
  5. 5Investigating Microsoft 365 Activities6 min
Read the chapter overview →
3Perform Threat Hunting4 topics · 26 min fast trackKQL in Defender XDR, threat analytics, hunting graphs, Sentinel hunting, the data lake and notebooks.
  1. 1Hunting with KQL in Defender XDR6 min
  2. 2Threat Analytics and Hunting Graphs6 min
  3. 3Sentinel Hunting Queries and the Data Lake7 min
  4. 4Notebooks, MCP and Sentinel Graph7 min
Read the chapter overview →

Ready for more practice?

The full Microsoft SC-200 question bank has 650 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.