This is a one-page SC-200 reference for the final days before the exam: the facts, the three domains, and the comparisons that questions are built around. It is a revision aid, not a replacement for the study plan.
Exam facts
| |
|---|
| Duration | 100 minutes |
| Passing score | 700 / 1000 (scaled) |
| Questions | Not published |
| Languages | 10 |
| Renewal | Free, every 12 months |
| English update | October 21, 2026 |
Domains
| Domain | Weight |
|---|
| Manage a security operations environment | 40–45% |
| Respond to security incidents | 35–40% |
| Perform threat hunting | 20–25% |
Sentinel automation
| Need | Use |
|---|
| Assign, tag, set status, close noisy incidents | Automation rule |
| Call other systems or run multi-step workflows | Playbook (Logic Apps) |
| Fastest detection on a simple query | NRT analytics rule |
| Joins or longer lookback | Scheduled analytics rule |
| Unusual behaviour via ML | Anomaly rule |
Sentinel roles
| Role | Can |
|---|
| Reader | View |
| Responder | Manage incidents |
| Contributor | Create and edit content |
| Automation Contributor | Service role for playbooks |
Data in
| Source | Method |
|---|
| Windows security events | AMA connector plus data collection rule |
| Windows events via forwarders | Windows Event Forwarding |
| Linux and appliances | Syslog or CEF via AMA |
| Azure activity | Azure Policy and diagnostic settings |
| No built-in table | Custom log table |
| Rarely queried bulk data | Data lake tier |
Defender for Endpoint response
| Action | Purpose |
|---|
| Isolate device | Contain |
| Live response | Interactive shell, collect files |
| Investigation package | Collect a snapshot of evidence |
| Device timeline | Reconstruct what happened |
| ASR rules | Prevent risky behaviours |
| Automation level (per device group) | Approval or full automatic remediation |
Microsoft 365 investigation
| Tool | Finds |
|---|
| Purview Audit | User and admin activity |
| eDiscovery content search | Items by content |
| Graph activity logs | Graph API calls |
Hunting tables (Defender XDR)
DeviceProcessEvents (processes), DeviceNetworkEvents (connections), DeviceLogonEvents (logons), DeviceFileEvents (files), EmailEvents (mail), IdentityLogonEvents (identity logons), CloudAppEvents (cloud apps). Defender uses Timestamp; Sentinel uses TimeGenerated.
KQL
| Operator | Use |
|---|
| where, project, extend | Filter, choose, calculate |
| summarize, bin | Aggregate, bucket time |
| join (inner, leftanti, leftouter) | Combine tables |
| has vs contains | Fast term match vs substring |
=~ vs == | Case-insensitive vs exact |
| let, union, parse | Reuse, stack, extract |
Threat analytics for active campaigns, hunting graphs with blast radius, Sentinel Graph for entity relationships, KQL jobs for data lake searches, summary rules for aggregated tables, notebooks for deeper analysis.
Test yourself with the practice test, then read exam tips.