ExamSprintLab

SC-200

SC-200: Security Operations Analyst

Everything you need for Microsoft exam SC-200: format, passing score, the three skill areas, a four-week study plan and free SOC scenario questions.

Duration
100 min
Passing score
700 / 1000
Level
Associate
Languages
10

SC-200, Microsoft Security Operations Analyst, is Microsoft’s exam for the people who sit in a security operations centre: who triage alerts, investigate incidents, hunt for threats and build the detections and automation that catch the next attack. Passing it earns the Microsoft Certified: Security Operations Analyst Associate credential.

The exam is built around two products and one language. The products are Microsoft Defender XDR (endpoints, email, identities and cloud apps, correlated into incidents) and Microsoft Sentinel (the cloud SIEM with its data connectors, analytics rules, automation and data lake). The language is KQL, the Kusto Query Language, which you use for advanced hunting, custom detections and every Sentinel query.

Microsoft expects you to be familiar with Microsoft security, compliance and identity solutions, Microsoft 365, Azure services, AI agents and Copilots, and Windows, Linux and mobile operating systems. You do not need to be a developer, but you do need to read and write short KQL queries without help.

What the exam covers

Skill areaWeight
Manage a security operations environment40–45%
Respond to security incidents35–40%
Perform threat hunting20–25%

The first two areas together make up 75-85% of the paper. Managing the environment is about configuration: automation, Sentinel setup, data ingestion and detection rules. Responding to incidents is about working the queue. Threat hunting is the smallest area but the one that rewards KQL skill most, and KQL also shows up inside the other two.

English is updated first: the English exam changes on October 21, 2026, and Microsoft’s change log lists only minor changes. See the exam format for details.

Where to start

Read the exam format for the mechanics, then how SC-200 compares with SC-500 if you are choosing between the analyst and the engineer route. The study plan fits in four weeks if you already work with Defender or Sentinel.

SC-200 guides

  1. SC-200 exam format: questions, score and costThe SC-200 format: 100 minutes, passing score 700, 10 languages, question types, the October 2026 update and what the three domain weights mean.
  2. SC-200 vs SC-500: analyst or engineer?SC-200 vs SC-500: the security operations analyst detects and responds to threats, the Cloud and AI Security Engineer builds controls. How to choose.
  3. SC-200 study plan: pass in 4 weeksA four-week SC-200 study plan: KQL and hunting, Sentinel setup and ingestion, detections and automation, then incident response, with a lab every week.
  4. Free SC-200 sample questions with answersFive free SC-200 practice questions on playbooks, retention tiers, device response, KQL hunting and Sentinel roles, each with an explained answer.
  5. SC-200 security operations environmentThe SC-200 largest domain explained: Defender XDR and Sentinel automation, platform setup, data ingestion with AMA and detections, with example questions.
  6. SC-200 respond to incidents explainedThe SC-200 incident response domain explained: working Defender XDR and Sentinel incidents, Defender for Endpoint response and Microsoft 365 investigation.
  7. SC-200 threat hunting explainedThe SC-200 threat hunting domain explained: advanced hunting, threat analytics, hunting graphs, Sentinel hunting, KQL jobs, summary rules and notebooks.
  8. SC-200 KQL explainedThe KQL you need for SC-200: operators, joins, time filters and summarize patterns for Defender XDR advanced hunting and Microsoft Sentinel.
  9. SC-200 exam tips: what to focus onPractical SC-200 exam tips: how to spend your revision, the traps in Defender XDR and Sentinel questions, KQL speed and managing the 100 minutes.
  10. SC-200 prerequisites: what to know firstSC-200 prerequisites: Microsoft lists no required certification, but the skills you should have in Microsoft security, Windows and Linux, Azure and KQL.
  11. Free SC-200 practice test: 20 questionsA free 20-question SC-200 practice test on Defender XDR, Sentinel, incident response and KQL hunting, weighted like the exam, with explained answers.
  12. SC-200 study resourcesWhat to study for SC-200: the official study guide and free practice assessment, the product docs worth reading and the labs that cover most of the exam.
  13. SC-200 cheat sheet: one-page referenceA one-page SC-200 cheat sheet: exam facts, domain weights, automation rule vs playbook, hunting tables, KQL operators and response tools.
  14. Is SC-200 hard? Difficulty explainedIs SC-200 hard? Where candidates struggle on the Microsoft Security Operations Analyst exam, who finds it easy and how to prepare for KQL and Sentinel.
  15. Is SC-200 worth it? Who should take itIs SC-200 worth it? Who should take the Microsoft Security Operations Analyst exam, what the certification shows and the alternatives for other security roles.
  16. SC-200 career: SOC roles and next stepsWhich SOC jobs SC-200 maps to, how analyst tiers differ, what the Security Operations Analyst Associate does not prove, and which exam to take after it.
  17. SC-200 renewal and retake rulesSC-200 lasts 12 months. How the free renewal assessment works, the six-month window, what expiry costs you, and retake waits after the Oct 21 2026 update.
  18. SC-200 scenarios: which study route fitsPlan SC-200 by background: SOC analyst, Microsoft 365 administrator or help desk career changer. Domain order, KQL gaps and an hour budget for each.