SC-200: Microsoft Security Operations Analyst
Prepare for SC-200 Security Operations Analyst with practice questions on threat detection, investigation, response using Microsoft Sentinel and Defender.
Pick how to study
The SC-200 exam
- Questions: 311
What SC-200 covers
Every question and flashcard is mapped to the SC-200: Microsoft Security Operations Analyst skills outline so you only revise what is on the exam.
- Manage a security operations environment
- Respond to security incidents
- Perform threat hunting
Why earn the SC-200 certification in 2026
SC-200 is Microsoft's associate-level certification for security operations analysts. Microsoft aims it at candidates who triage, respond to, and hunt for threats using Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra ID, and Microsoft Purview. There is no prerequisite certification. The exam covers managing a security operations environment, responding to security incidents, and performing threat hunting.
Who should sit this exam
SOC analysts working with Microsoft Sentinel, security operations engineers using Defender products, incident response professionals, and threat hunters investigating advanced attacks.
Exam tips
- Master KQL (Kusto Query Language) for threat hunting in Sentinel and Defender
- Know Microsoft Sentinel workspace design, data connectors, and analytics rules
- Understand incident investigation workflows across the Microsoft 365 Defender suite
- Practice creating automated playbooks with Logic Apps for incident response
SC-200 study resources
- Build a study plan: tell us your exam date and we schedule daily practice and review sessions backwards from the date.
- Decision sheets: each sheet settles one choice between look-alike services, verdict first, then the comparison, then the traps.
Frequently asked about SC-200
How many questions are in the SC-200 practice exam?
The SC-200 practice exam covers Microsoft Sentinel, threat detection, incident response, threat hunting, and security operations. The current question count is shown on the SC-200 landing page.
What is Microsoft Sentinel?
Microsoft Sentinel is Azure's cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution. SC-200 focuses on using Sentinel for security operations.
Do I need KQL knowledge for SC-200?
Yes, SC-200 requires strong Kusto Query Language (KQL) skills for threat hunting, creating analytics rules, and investigating security incidents in Microsoft Sentinel and Microsoft 365 Defender.
Other Associate certifications
Ready for SC-200?
Try the practice surface for free. Answer a few questions, see the spacing loop, then decide. Try 10 free SC-200 questions or browse the catalogue.
AzurePrep is an independent practice-exam platform and is not affiliated with or endorsed by Microsoft.