Search...
Everything needed to plan for the Security Operations Analyst (SC-200) (SC-200) exam: number of questions, time limit, passing score, and the official domain weightings. For the domain checklist, see the SC-200 study guide. For a week-by-week plan, see the SC-200 study plan.
Facts last checked . Vendor links for this exam are on the materials page. To correct a figure, use the corrections policy.
Security Operations Analyst (SC-200) (SC-200) is a Associate level Microsoft certification exam with 60 questions in 120 minutes (last checked 2026-10-19), requiring a scaled score of 700 to pass. It covers 3 domains: Manage a security operations environment (43%); Perform threat hunting (30%); Respond to security incidents (27%).
Exam code
SC-200
Questions
60
Time limit
120 min
Passing score
700 scaled
Official domains
3
Level
Associate
Provider
Microsoft
Practice questions
300+ on CertStud
| Domain | Weight | What it covers |
|---|---|---|
| Manage a security operations environment | 43% | Configure and manage Microsoft Sentinel workspace, data connectors, automation, and analytics |
| Perform threat hunting | 30% | Proactively hunt for threats using KQL queries and Advanced Hunting in Sentinel and Defender |
| Respond to security incidents | 27% | Investigate and remediate security incidents using Microsoft Sentinel and Defender XDR |
Percentages reflect published official domain weightings. Prerequisite knowledge and current scoring rules are confirmed on the Microsoft exam page before booking.
The SC-200 figure on file is 60 questions. Last checked 2026-10-19. Confirm the current figure with Microsoft before you book.
The SC-200 time limit on file is 120 minutes. Last checked 2026-10-19. Confirm the current figure with Microsoft before you book.
The SC-200 exam requires a scaled score of 700 to pass. A scaled score is not a raw percentage of correct answers. Last checked 2026-10-19. Confirm the current figure with Microsoft before you book.
The SC-200 exam covers 3 official domains: Manage a security operations environment (43%), Respond to security incidents (27%), Perform threat hunting (30%).
Manage a security operations environment carries the heaviest weighting on the SC-200 exam at 43% of the exam. Configure and manage Microsoft Sentinel workspace, data connectors, automation, and analytics
SC-200 is the exam code for Security Operations Analyst (SC-200) (Microsoft Security Operations Analyst), a Associate level Microsoft certification exam covering 3 domains.
The SC-200 exam reports a scaled score. The passing score on file is 700. Plan for 60 questions across 120 minutes, weighted by domain: 43% Manage a security operations environment, 30% Perform threat hunting, 27% Respond to security incidents. Last checked 2026-10-19. Confirm the current figure with Microsoft before you book.
CertStud offers free SC-200 practice questions with detailed explanations, plus full-length practice exams and flashcards at https://certstud.com/certifications/microsoft/sc-200. Start with 10 free questions at https://certstud.com/try-free.