I85PREP
⌘ K
SC-200 study materials
SC-200 study resources

SC-200: Manage a Security Operations Environment

SC-200 · Work through your exam, one topic at a time.

All guide sections

Manage a Security Operations Environment

What to know

This domain tests your ability to configure Microsoft Sentinel as a working SOC platform rather than just a log sink. Core concepts: workspaces and the Log Analytics data model, data connectors and ingestion (including the difference between the Azure Monitor Agent / AMA and the legacy Log Analytics agent), the Sentinel data lake and analytics rules, watchlists, automation rules versus playbooks, and role-based access control both at the workspace and at the Sentinel resource level.

Traps to expect

  • RBAC confusion. Sentinel has its own roles (Sentinel Reader, Sentinel Responder, Sentinel Contributor) in addition to Azure RBAC. Questions often ask for the least privilege needed for a task - e.g., an analyst who only triages incidents needs Sentinel Responder, not Contributor.
  • Automation rules vs. playbooks. Automation rules run on the incident/alert trigger and can be created in the portal without Logic Apps; playbooks are Logic Apps and are needed for actions like calling an external API. Questions frequently describe a scenario where the "no-code" answer is the automation rule.
  • Retention and cost. Analytics/security logs and the data lake have different retention and pricing behavior; don't assume interactive retention equals total retention.
  • Connector vs. DCR. Data collection rules define what the agent collects; the connector defines the table mapping. Mixing these up is a classic distractor.

Worked example

A question asks how to ensure only the SOC tier-1 team can view incidents but not edit analytics rules. Rule of thumb: assign Microsoft Sentinel Reader at the workspace scope to the tier-1 group, and reserve Sentinel Contributor for engineers. If the scenario mentions "run a playbook automatically when a high-severity incident is created," the answer is an automation rule with a playbook action, not a scheduled query rule.

Rule of thumb

When a question asks "who can do X," pick the narrowest built-in role that includes X; when it asks "how does X happen automatically," decide first whether the trigger is an incident (automation rule) or a query (analytics rule).