Exam SC-200: Microsoft Security Operations Analyst is the standard certification for SOC analyst roles on the Microsoft stack. It tests whether you can run a security operations environment with Microsoft Defender XDR and Microsoft Sentinel, respond to incidents across endpoints, email, identities, cloud apps and cloud workloads, and hunt for threats with KQL. The skills measured were updated on 21 October 2026 and now include investigating with Security Copilot, Sentinel data lake KQL jobs, Sentinel Graph and the Sentinel MCP Server.
SOC analyst is one of the most common fresher and early-career security roles in Hyderabad, Bengaluru and Pune, and SC-200 maps directly to that work. This guide follows the official study guide: three skill areas with weights, KQL you must know, a 6-week plan and 15 original scenario questions.
Quick facts (Microsoft Learn, November 2026)
| Item | Detail |
|---|---|
| Certification | Microsoft Certified: Security Operations Analyst Associate (Intermediate) |
| Time | 100 minutes; proctored; may include interactive components |
| Passing score | 700 |
| Languages | English, Japanese, Chinese (Simplified), Korean, French, German, Spanish, Portuguese (Brazil), Chinese (Traditional), Italian |
| Price | Based on the country where you take the exam (Pearson VUE) |
| Renewal | Every 12 months, with a free online assessment |
| Skills measured | As of 21 October 2026 |
Read the official certification page and SC-200 study guide before booking.
Who should take SC-200?
- Freshers and junior analysts aiming for SOC L1/L2 roles.
- System and network administrators moving into security.
- Cloud engineers who want a security operations credential next to SC-500.
Skills measured and weights
| Skill area | Weight |
|---|---|
| Manage a security operations environment | 40–45% |
| Respond to security incidents | 35–40% |
| Perform threat hunting | 20–25% |
1. Manage a security operations environment (40–45%)
- Automation in Defender XDR and Sentinel: email and alert notifications (tuning, suppression, correlation); Defender for Endpoint advanced features, rules, custom data collection and security policies including attack surface reduction (ASR) rules; automated investigation and response; automatic attack disruption; device groups and automation levels; Sentinel automation rules and playbooks.
- Sentinel platform: Sentinel roles; data retention across Analytics, Data lake and XDR tiers; workbooks; SOC optimisation recommendations.
- Data ingestion: choosing connectors; Windows Security events via AMA and data collection rules; Windows Event Forwarding; Syslog and CEF via AMA; Azure activity logs via Azure Policy and diagnostic settings; threat indicators; custom log tables.
- Detections: custom detection rules from Advanced Hunting; Sentinel analytics rules (scheduled, NRT, threat intelligence, ML); MITRE ATT&CK coverage; anomalies.
2. Respond to security incidents (35–40%)
- Defender XDR: threats from Defender for Office 365, Purview, Defender for Cloud workload protections, Defender for Cloud Apps, Entra ID (compromised identities), Defender for Identity and Sentinel; investigating with Microsoft Security Copilot; multi-stage attacks and lateral movement; case management.
- Defender for Endpoint: device timelines; live response and investigation packages; evidence and entities; attack disruption incidents.
- Microsoft 365: Purview Audit, Content search in eDiscovery, and Microsoft Graph activity logs.
3. Threat hunting (20–25%)
- Defender XDR: choosing the right table; KQL; Advanced Hunting queries; threat analytics; hunting graphs and blast radius; Sentinel Graph relationships.
- Sentinel: hunting queries; KQL jobs in the data lake; summary rule tables; notebooks, including the Sentinel MCP Server.
KQL you must be able to read and write
// Failed sign-ins followed by a success from the same IP (possible password spray)
SigninLogs
| where TimeGenerated > ago(1d)
| summarize Failures = countif(ResultType != "0"), Successes = countif(ResultType == "0"),
Users = dcount(UserPrincipalName) by IPAddress
| where Failures > 20 and Successes > 0 and Users > 5
| order by Failures desc
// Advanced Hunting: PowerShell downloading content on endpoints
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "powershell.exe" and ProcessCommandLine has_any ("DownloadString", "Invoke-WebRequest", "iwr ")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine| Table | What's in it |
|---|---|
| SigninLogs | Entra ID interactive sign-ins (Sentinel) |
| SecurityEvent | Windows Security events collected via AMA (Sentinel) |
| Syslog / CommonSecurityLog | Linux Syslog and CEF appliance logs (Sentinel) |
| DeviceProcessEvents, DeviceNetworkEvents | Endpoint process and network activity (Defender XDR) |
| EmailEvents | Mail flow and verdicts from Defender for Office 365 |
| IdentityLogonEvents | On-premises AD activity from Defender for Identity |
6-week study plan
| Week | Focus | Lab |
|---|---|---|
| 1 | KQL basics: where, summarize, join, project, time filters | Write 20 queries on the free demo data |
| 2 | Sentinel workspace, roles, connectors (AMA, DCRs, Syslog/CEF), retention tiers | Connect a Windows VM and a Linux VM |
| 3 | Analytics rules, MITRE ATT&CK, automation rules and playbooks | Rule for password spray plus a playbook that posts to Teams |
| 4 | Defender for Endpoint: ASR, device groups, live response, timelines | Onboard a test device and investigate a simulated alert |
| 5 | Defender for Office 365, Identity, Cloud Apps, Purview Audit, Security Copilot | Trace a phishing incident end to end |
| 6 | Advanced Hunting, data lake KQL jobs, summary rules, notebooks; Practice Assessment | Hunt for lateral movement; book the exam |
15 scenario questions with answers
These are original scenarios written for this guide, not exam questions.
1. Office documents keep launching child processes that run scripts. What blocks this on endpoints?
Attack surface reduction (ASR) rules in Defender for Endpoint.
2. Every high-severity Sentinel incident must automatically be assigned to the on-call analyst and tagged. What do you create?
An automation rule.
3. A compromised user should be disabled and a ticket raised automatically. What do you use?
A Sentinel playbook (Logic Apps) triggered from an automation rule.
4. Linux firewall appliances send CEF logs. How do you collect them?
The CEF via AMA connector with a data collection rule on a log forwarder.
5. You must keep raw logs for two years cheaply but still query them occasionally. Which tier?
The Sentinel data lake tier, queried with KQL jobs.
6. An alert must fire within about a minute of a specific event. Which analytics rule type?
Near-real-time (NRT).
7. Management asks which attack techniques you can't detect yet. What do you use?
MITRE ATT&CK coverage analysis in Sentinel.
8. An attack is spreading and Defender should contain devices and accounts automatically. Which feature?
Automatic attack disruption in Defender XDR.
9. You need a memory dump and logs from a suspicious laptop without physical access. What do you do?
Collect an investigation package or use a live response session in Defender for Endpoint.
10. Which Defender product flags pass-the-hash on on-premises Active Directory?
Microsoft Defender for Identity.
11. You must find who accessed a sensitive SharePoint file last month. Where?
Microsoft Purview Audit.
12. A junior analyst wants a summary and next steps for a complex incident. What helps?
Microsoft Security Copilot embedded in Defender XDR.
13. You want to see everything an attacker could reach from a compromised device. What do you build?
A hunting graph showing the blast radius (Sentinel Graph relationships).
14. A hunting query over a year of data is too slow to run daily. What helps?
Summary rules that pre-aggregate into summary tables, or a scheduled KQL job in the data lake.
15. Which KQL operator counts events per user?summarize count() by UserPrincipalName.
After SC-200
- Build a portfolio project: the SOC AI assistant project.
- Read AI, cloud and cyber security skills and the SC-500 guide.
- See live security jobs.
Cloud Soft Solutions in Ameerpet, Hyderabad teaches cyber security, SOC operations and cloud security with hands-on labs. See the APEX AI, ML, Cloud and Cyber Security program and all courses.
📞 Call +91 96660 19191 · WhatsApp · Flat No. 513, 5th Floor, Nilagiri Block, Aditya Enclave, Ameerpet, Hyderabad
Frequently Asked Questions
How long is the SC-200 exam?
100 minutes. It is proctored and may include interactive components.
What is the passing score for SC-200?
700.
Which SC-200 skill area has the most weight?
Manage a security operations environment, at 40–45%.
When were the SC-200 skills last updated?
The current skills measured apply as of 21 October 2026.
Do I need KQL for SC-200?
Yes. Threat hunting (20–25%) uses KQL in Defender XDR Advanced Hunting and Microsoft Sentinel.
How often must SC-200 be renewed?
Every 12 months, with a free online renewal assessment on Microsoft Learn.
