SC-200 is the Microsoft Security Operations Analyst Associate exam. You hunt, detect, and respond with Microsoft Defender XDR, Microsoft Sentinel, and Defender for Cloud.
Start practicing: SC-200 practice →
Optional literacy first: SC-900. Path: Microsoft security path.
Exam overview
| Detail | Info |
|---|---|
| Exam | SC-200 |
| Duration | ~120 minutes |
| Pass | 700 / 1000 |
| Cost | ~$165 USD |
Official: SC-200 skills.
What to study
- Mitigate threats with Defender XDR — incidents, automated investigation, device/email/identity signals.
- Microsoft Sentinel — data connectors, analytics rules, KQL at associate depth, workbooks, automation rules / playbooks.
- Defender for Cloud — recommendations, regulatory standards, cloud workload protection at SOC-consumer depth.
KQL is the highest-miss skill. Practice queries until you can filter a table without a cheat sheet.
5-week plan
| Week | Focus |
|---|---|
| 1 | Defender incidents and portals |
| 2–3 | Sentinel connectors, rules, KQL |
| 4 | Defender for Cloud + automation |
| 5 | 300+ questions + mocks |
- Practice · Flashcards · Notes · Exams
Ready to Pass Your Microsoft SC-200 Exam?
Get 300+ practice questions with detailed explanations, flashcards, and full-length practice exams. Try 10 free practice questions. Unlock 300+ questions and timed exams when you are ready.
✓ Plans from $19.99/mo • ✓ Cancel anytime • ✓ 91 certifications
