Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by Microsoft
Exam Format
Registration
Validity
Skills this practice test covers
- Plan a Microsoft Sentinel workspace, assign its roles and connect its data sources.
- Tune Microsoft Defender XDR detections, from custom detection rules to alert suppression.
- Investigate incidents raised by Defender for Endpoint, Defender for Office 365 and Microsoft Entra ID.
- Automate incident handling with Microsoft Sentinel automation rules and playbooks.
- Hunt for threats with KQL queries, hunting bookmarks and search jobs.
- Investigate an incident with Security Copilot promptbooks and plugins.
Explore related topics
SC-200 exam content
4 domains · 41 topics · 284 of 297 questions sorted by domain
Manage a security operations environment69 questions
This domain covers the setup work done before any alert arrives. Candidates configure Microsoft Defender XDR, manage devices and exposure, and design a Microsoft Sentinel workspace and the data that flows into it.
Skills tested
- Configure notification rules, endpoint rules settings and advanced features for Microsoft Defender for Endpoint.
- Set device groups, permissions and automation levels, and find unmanaged devices.
- Plan a Microsoft Sentinel workspace with the right roles, log types and log retention.
- Ingest data through Content hub solutions, Syslog and CEF collection, and data collection rules.
- Monitor and optimize data ingestion, and keep custom data in custom log tables.
Questions by topic
- Manage automated investigation and response capabilities in Microsoft3
- Plan a Microsoft Sentinel workspace5
- Design and configure Microsoft Sentinel data storage, including log6
- Ingest data sources in Microsoft Sentinel4
- Configure Microsoft Sentinel roles5
- Plan and configure collection of Windows Security events by using data3
- Identify unmanaged devices in Microsoft Defender for Endpoint5
- Identify and remediate devices at risk by using Microsoft Defender6
- Implement and use Content hub solutions5
- Plan and configure Syslog and Common Event Format (CEF) event4
- Mitigate risk by using Exposure Management in Microsoft Defender XDR4
- Configure automatic attack disruption in Microsoft Defender XDR4
- Configure and use Microsoft connectors for Azure resources, including3
- Monitor and optimize data ingestion7
- Discover unprotected resources by using Defender for Cloud2
- Create and configure Microsoft Sentinel playbooks1
- Create custom workbooks that include KQL1
- Create and configure Microsoft Sentinel workbooks1
Configure protections and detections54 questions
This domain pairs the policies that block threats with the rules that detect them. Candidates set policies across the Defender products, then build and tune detections in Defender XDR and Microsoft Sentinel.
Skills tested
- Configure policies for Defender for Cloud Apps, Defender for Office 365 and Defender for Endpoint, including ASR rules.
- Turn on cloud workload protections in Microsoft Defender for Cloud.
- Write custom detection rules, and tune, suppress and correlate the alerts they raise.
- Build analytics rules in Microsoft Sentinel that map entities and query data through ASIM parsers.
- Set up deception rules with decoys and lures, and turn on behavioral analytics.
Questions by topic
- Configure and manage analytics rules13
- Configure cloud workload protections in Microsoft Defender for Cloud5
- Configure policies for Microsoft Defender for Cloud Apps8
- Configure security policies for Microsoft Defender for Endpoints,3
- Configure deception rules in Microsoft Defender XDR5
- Manage alerts, including tuning, suppression, and correlation4
- Implement behavioral analytics5
- Configure security policies for Microsoft Defender for Endpoints, including attack surface reduction (ASR) rules4
- Configure and manage custom detection rules3
- Create and configure automation rules2
- Configure and use Microsoft connectors for Azure resources, including1
- Query Microsoft Sentinel data by using ASIM parsers1
Manage incident response101 questions
The largest domain follows an incident from the first alert to the fix. Candidates investigate in the Microsoft Defender portal, on devices, in Microsoft 365 logs and in Microsoft Sentinel, and they use Security Copilot during investigations.
Skills tested
- Investigate ransomware, business email compromise and data loss incidents in the Microsoft Defender portal.
- Investigate a device with its timeline, a live response session and an investigation package.
- Trace Microsoft 365 activity with the unified audit log, Content Search and Microsoft Graph activity logs.
- Handle Microsoft Sentinel incidents with automation rules and playbooks, including playbooks for on-premises resources.
- Set up Security Copilot plugins, connectors and roles, and use promptbooks to investigate incidents.
Manage security threats60 questions
This domain is about hunting: looking for attacks that no rule has flagged yet. Candidates write KQL in Defender XDR and Microsoft Sentinel, check coverage against MITRE ATT&CK, and share the results in workbooks.
Skills tested
- Write custom hunting queries in KQL, and read threat analytics in the Microsoft Defender portal.
- Measure attack vector coverage with the MITRE ATT&CK matrix in Microsoft Sentinel.
- Create and manage hunts, monitor hunting queries, and save findings as hunting bookmarks.
- Retrieve archived log data and run search jobs across large data sets.
- Customize workbook templates and build custom workbooks with KQL and visualizations.
Questions by topic
- Identify threats by using Kusto Query Language (KQL)13
- Create and configure Microsoft Sentinel workbooks5
- Use hunting bookmarks for data investigations6
- Manage and use threat indicators6
- Create custom workbooks that include KQL4
- Create custom hunting queries by using KQL10
- Analyze attack vector coverage by using the MITRE ATT&CK matrix6
- Interpret threat analytics in the Microsoft Defender portal3
- Create and monitor hunting queries2
- Create and manage hunts4
- Configure visualizations1
Requirements
- No formal prerequisites: anyone can book the exam.
- Recommended: familiarity with Microsoft 365, Azure cloud services, and Windows, Linux and mobile operating systems.
- Recommended: hands-on experience with Microsoft Sentinel, KQL, and threat detection and response.
About the SC-200 exam
Microsoft's SC-200 exam is for security operations analysts who triage alerts, respond to incidents and hunt for threats across cloud and on-premises systems. The main tools are Microsoft Defender XDR, Microsoft Sentinel, Microsoft Defender for Cloud and Security Copilot, with KQL for detections, reports and investigations. Candidates should already know Microsoft 365, Azure cloud services, and Windows, Linux and mobile operating systems. Passing earns Microsoft Certified: Security Operations Analyst Associate, which Microsoft asks holders to renew each year with a free online assessment.
Manage incident response is the largest domain, and the PlanetCert practice test gives it the most questions, from device timelines and live response to Microsoft Sentinel playbooks. Every answer has an explanation, which helps most where two features look alike, such as automation rules and playbooks, or analytics rules and custom detection rules. Study Mode suits the hunting domain, because it leaves time to trace each KQL query step by step. Brainy AI Assistant can break a query down line by line, or explain how a search job differs from a hunting query.
How to earn the certification
- Earns
- Microsoft Certified: Security Operations Analyst AssociateAssociate
The certification is valid for one year. Holders renew it at no cost by passing an online assessment on Microsoft Learn.
- Before
- SC-900 Security, Compliance, and Identity Fundamentals
Optional. The fundamentals exam on the security, compliance and identity concepts behind Microsoft's security products.
- SC-900 Security, Compliance, and Identity Fundamentals
- After
- SC-100 Cybersecurity Architect
Microsoft's expert-level security design exam. Its certification also requires one associate certification, and this one is accepted.
- SC-100 Cybersecurity Architect
How to prepare for SC-200
- 1
Build a trial tenant with Sentinel
Use a trial Microsoft 365 tenant and an Azure subscription with a Microsoft Sentinel workspace. Onboard one test device to Defender for Endpoint, so alerts, device timelines and live response can be tried by hand.
- 2
Connect three data sources first
Collect Windows Security events through a data collection rule, Syslog or CEF from a Linux machine, and one Content hub solution. Detections and hunts make more sense once each source's table is familiar.
- 3
Learn KQL one operator at a time
Start with where, project, summarize and join, then write small hunting queries against sign-in and security event data. KQL is used in detections, hunting and workbooks, so this time helps in several domains.
- 4
Give incident response the most hours
Manage incident response carries the largest share of the exam. Walk one incident from the Defender portal through the device timeline and the unified audit log to a Microsoft Sentinel playbook.
- 5
Finish in Timed Mode, then review
Take the SC-200 practice test in Timed Mode once each domain feels solid. For every missed question, ask Brainy AI Assistant which detail in the scenario pointed to the right tool, then repeat that task in the lab.
Start a timed SC-200run
Microsoft's official course is Microsoft Security Operations Analyst. Its learning paths include SC-200: Mitigate threats using Microsoft Defender XDR, SC-200: Connect logs to Microsoft Sentinel and SC-200: Perform threat hunting in Microsoft Sentinel.
Who SC-200 is for
- Security operations center analysts who triage alerts and run incidents in Microsoft Defender XDR and Microsoft Sentinel.
- Security engineers who build detections, automation and workbooks on Microsoft security tools.
- Incident responders and threat hunters who search logs with KQL.
- IT administrators on Microsoft 365 and Azure who are moving into security operations.
Typical job titles: Security operations analyst · SOC analyst · Incident responder · Threat hunter · Detection engineer · Security engineer
SC-200 glossary
19 terms from the exam objectives and the vendor's official material, each defined in a sentence.
- Analytics rules
- Microsoft Sentinel rules that run queries on a schedule or in near real time, and create alerts and incidents when they find a match.
- ASIM parsers
- Parsers of the Advanced Security Information Model that show data from different sources in one normalized schema, so one query works across all of them.
- Attack surface reduction (ASR) rules
- Defender for Endpoint rules that block behaviors malware often uses, such as an Office app starting a child process or a script running obfuscated code.
- Automatic attack disruption
- A Defender XDR capability that contains an attack in progress, for example by disabling a compromised user account or containing a device, without waiting for an analyst.
- Automation rules
- Microsoft Sentinel rules that act when an incident or alert is created or updated, for example to assign an owner, change the status or run a playbook.
- Common Event Format (CEF)
- A standard text format for security events, carried over Syslog, that many firewalls and network appliances use to send logs to Microsoft Sentinel.
- Content hub
- The Microsoft Sentinel catalog of packaged solutions. Each solution bundles items such as data connectors, analytics rules, workbooks and playbooks.
- Deception rules
- Defender XDR rules that plant decoy accounts, hosts and lures, so an attacker who touches them sets off a high-confidence alert.
- Exposure Management
- The Defender XDR area that shows an organization's attack surface and the paths an attacker could take, so weak points can be fixed before an attack.
- Hunting bookmarks
- Saved results from a Microsoft Sentinel hunting query, kept so the events can be investigated later or added to an incident.
- Kusto Query Language (KQL)
- The query language for log data in Microsoft Sentinel and in advanced hunting in Defender XDR. A query passes data through a chain of operators, such as where and summarize.
- Live response
- A Defender for Endpoint feature that opens a remote shell on a device, so an analyst can collect files, run scripts and remove threats.
- Microsoft Defender XDR
- Microsoft's extended detection and response suite. It joins signals from endpoints, email, identities and cloud apps into incidents in the Microsoft Defender portal.
- Microsoft Sentinel
- Microsoft's cloud security information and event management (SIEM) service. It collects logs in a workspace, runs detections on them and supports hunting and automated response.
- MITRE ATT&CK matrix
- A public table of attacker tactics and techniques. Microsoft Sentinel maps rules and queries to it, which shows the techniques that are covered and the gaps.
- Promptbooks
- Saved sets of Security Copilot prompts that run in order to complete a task, such as summarizing an incident or analyzing a script.
- Search jobs
- Long-running Microsoft Sentinel searches across large or archived data, which save their results to a new table for analysis.
- Unified audit log
- The Microsoft 365 record of user and admin actions across services such as Exchange Online, SharePoint and Teams. Investigators use it to see what an account did.
- Windows Event Forwarding (WEF)
- A Windows feature that sends events from many computers to one collector, from which they can be ingested into Microsoft Sentinel.