SC-200 study plan

Map every Microsoft Defender portal blade (incidents, alerts, hunting, advanced hunting, settings) to the SOC task it supports, writing a one-line purpose for each.

Configure role-based access control in Microsoft Defender XDR by assigning a custom role to a test user and verifying the resulting permissions.

Enable and tune at least three alert policies, documenting the severity and threshold you changed and why.

Sketch the data connectors feeding Microsoft Sentinel for a sample tenant and label which log sources are native versus via AMA or Codeless Connector Framework.

Configure Microsoft Sentinel onboarding for a test workspace, including enabling the Microsoft 365 and Azure Activity data connectors.

Build two analytics rules from scratch (one scheduled, one near-real-time) and validate each by generating a matching test event.

Create an automation rule that assigns an incident to a group and applies a tag, then confirm the behavior on a triggered incident.

Design a watchlist and upload a CSV so a KQL query can join against it.

Triage a simulated incident end to end: classify, assign, set status, and record evidence in incident comments.

Author a playbook in Logic Apps that enriches an incident with device risk and posts the result to a Teams channel.

Define an incident severity matrix that maps business impact and scope to P1-P4 and justify each tier.

Configure a manual attack disruption or containment action and document its preconditions and rollback path.

Execute containment for a compromised identity: revoke sessions, reset password, and confirm sign-in risk returns to clean.

Isolate a test device through Defender for Endpoint live response and collect a forensic package.

Write a post-incident review template covering timeline, root cause, detection gaps, and follow-up actions.

Automate a phishing-submission workflow that extracts URLs and submits them for detonation.

Write ten advanced hunting queries in KQL spanning sign-in anomalies, process creation, and network connections.

Convert one hunting query into a custom detection rule and verify it fires on replayed data.

Use the hunting schema reference to identify which tables hold identity, endpoint, and email telemetry and note retention differences.

Correlate two data sources in a single query to surface a behavior neither source shows alone.

Hunt for a living-off-the-land technique using command-line telemetry and document the hypothesis, query, and findings.

Build a Sentinel workbook that visualizes hunting results over time.

Perform threat intelligence matching by importing an indicator feed and writing a query that joins it to sign-in or process events.

Create a scheduled hunting routine with defined hypotheses and a triage path for positive hits.

Re-run a full mock incident from alert to closure under a 45-minute timer to test speed and completeness.

Audit your Sentinel and Defender configuration against least-privilege principles and fix at least two gaps.

Review every analytics rule you built for false-positive rate using historical data and tune thresholds.

Practice explaining an incident timeline aloud as if briefing a stakeholder.

Complete a full-length timed practice assessment and log every missed objective by domain.

Re-study the two weakest objectives until you can explain them without notes.

Rehearse the end-to-end flow from hunt hypothesis to incident closure in a single continuous exercise.

Finalize a one-page quick-reference card of KQL patterns, portal paths, and severity rules for exam-day recall.