SC-200 study guide
SC-200 · Work through your exam, one topic at a time.
The Microsoft Certified: Security Operations Analyst Associate credential is an intermediate-level, Azure-focused certification for security professionals who investigate, search for, and mitigate threats using Microsoft Sentinel, Microsoft Defender for Cloud, and Microsoft 365 Defender. Microsoft positions the role around reducing organizational risk through triage, incident response, threat hunting, and detection engineering, working across Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra ID, Microsoft Purview, and Defender for Cloud workload protections in multi-cloud and on-premises environments. Candidates should already be familiar with Microsoft security, compliance, and identity solutions; Microsoft 365; Azure cloud services; AI agents and Copilots; and Windows, Linux, and mobile operating systems. The exam assesses three areas: managing a security operations environment, responding to security incidents, and performing threat hunting. The SC-200 study guide has 3 sections and about 1,098 words.
01Manage a Security Operations Environment
This domain tests your ability to configure Microsoft Sentinel as a working SOC platform rather than just a log sink. Core concepts: workspaces and the Log Analytics data model, data connectors and ingestion (including the difference between the Azure Monitor Agent / AMA and the legacy Log Analytics agent), the Sentinel data lake and analytics rules, watchlists, automation rules versus playbooks, and role-based access control both at the workspace and at the Sentinel resource level.
394 words, about 2 min02Respond to Security Incidents
This domain covers the incident lifecycle in Microsoft Sentinel and Microsoft Defender XDR: triage, investigation, evidence gathering, and remediation. Key concepts: incident grouping and entities (accounts, hosts, IPs, URLs), the incident investigation graph, bookmarks and comments, the difference between alerts and incidents , incident tasks, and automated response via automation rules and playbooks.
361 words, about 2 min03Perform Threat Hunting
Threat hunting in SC-200 centers on KQL (Kusto Query Language) in Microsoft Sentinel and Defender XDR advanced hunting. You must know the hunting workflow: form a hypothesis, query telemetry, validate findings, and promote results into detections.
343 words, about 2 min