Search...

Quick Feedback

Back to Security Operations Analyst (SC-200)

Security Operations Analyst (SC-200) Study Guide

Domain-by-domain study guide for Microsoft Security Operations Analyst (SC-200). Covers all 3 exam objectives with topic checklists, quick notes, and practice links.

Download PDF Notes

Exam Overview

Key facts before you start studying

Duration

120 min

Questions

Exam Code

SC-200

Domains

Quick Navigation

Jump to a specific exam domain

1. Manage a security operations environment (43%)
2. Respond to security incidents (27%)
3. Perform threat hunting (30%)

Domain 1

43%

Manage a security operations environment

Configure and manage Microsoft Sentinel workspace, data connectors, automation, and analytics

Topics to Master

Microsoft Sentinel workspace configuration
Data connectors and log ingestion
Analytics rules and alerts
Automation and SOAR playbooks
Microsoft Sentinel roles and permissions
Data retention and archival
Microsoft Security solutions integration

Domain 2

27%

Respond to security incidents

Investigate and remediate security incidents using Microsoft Sentinel and Defender XDR

Topics to Master

Incident triage and prioritization
Investigation using entity pages
Threat intelligence integration
Microsoft Defender XDR unified incidents
Remediation actions and containment
Incident response playbooks
Post-incident activities and reporting

Domain 3

30%

Perform threat hunting

Proactively hunt for threats using KQL queries and Advanced Hunting in Sentinel and Defender

Topics to Master

KQL query language fundamentals
Advanced Hunting in Microsoft Defender XDR
Custom detection rules
Hunting queries and bookmarks
Threat indicators and watchlists
Live Response and investigation packages
Hunting across Microsoft security products

Continue Your Prep

Free CertStud resources for SC-200

Study Notes Exam Study Plan Start Practice Test

Back to Security Operations Analyst (SC-200)

Security Operations Analyst (SC-200) Study Guide

Domain-by-domain study guide for Microsoft Security Operations Analyst (SC-200). Covers all 3 exam objectives with topic checklists, quick notes, and practice links.

Download PDF Notes

Exam Overview

Key facts before you start studying

Duration

120 min

Questions

Exam Code

SC-200

Domains

Quick Navigation

Jump to a specific exam domain

1. Manage a security operations environment (43%)
2. Respond to security incidents (27%)
3. Perform threat hunting (30%)

Domain 1

43%

Manage a security operations environment

Configure and manage Microsoft Sentinel workspace, data connectors, automation, and analytics

Topics to Master

Microsoft Sentinel workspace configuration
Data connectors and log ingestion
Analytics rules and alerts
Automation and SOAR playbooks
Microsoft Sentinel roles and permissions
Data retention and archival
Microsoft Security solutions integration

Domain 2

27%

Respond to security incidents

Investigate and remediate security incidents using Microsoft Sentinel and Defender XDR

Topics to Master

Incident triage and prioritization
Investigation using entity pages
Threat intelligence integration
Microsoft Defender XDR unified incidents
Remediation actions and containment
Incident response playbooks
Post-incident activities and reporting

Domain 3

30%

Perform threat hunting

Proactively hunt for threats using KQL queries and Advanced Hunting in Sentinel and Defender

Topics to Master

KQL query language fundamentals
Advanced Hunting in Microsoft Defender XDR
Custom detection rules
Hunting queries and bookmarks
Threat indicators and watchlists
Live Response and investigation packages
Hunting across Microsoft security products

Continue Your Prep

Free CertStud resources for SC-200

Study Notes Exam Study Plan Start Practice Test