SC-200 exam format: questions, score and cost

SC-200 gives you 100 minutes, requires a scaled score of 700 out of 1000 to pass, and is priced per country at the booking step. Microsoft does not publish the number of questions. Here is everything else it publishes, and what it means for your preparation.

The three domains

Managing the environment is the largest block and has four groups of objectives: automation for Defender XDR and Sentinel (notifications, Defender for Endpoint settings, attack surface reduction rules, automatic attack disruption, automation rules and playbooks), the Sentinel platform (roles, retention across the analytics, data lake and XDR tiers, workbooks, SOC optimization), data ingestion (connectors, Azure Monitor Agent collection, Syslog and CEF, Windows Event Forwarding, threat indicators, custom tables) and detections (custom detection rules, analytics rules, MITRE ATT&CK coverage, anomalies).

Responding to incidents covers working alerts across the Defender products, Purview, Entra ID and Sentinel, including investigation with agentic AI and Security Copilot, plus device-level response in Defender for Endpoint and investigation with Purview Audit, eDiscovery content search and Microsoft Graph activity logs.

Threat hunting is the smallest area, but it is the one that depends entirely on KQL.

The October 21, 2026 update

Microsoft updates the English exam first. The study guide shows the skills measured as of October 21, 2026, and the certification page states that the English version is updated on that date. The published change log lists no change to the audience profile or to the domain structure, and a minor change in the data ingestion objectives. Localised versions follow roughly eight weeks later, so a non-English exam taken shortly after the update may still follow the earlier outline.

Prepare from the current study guide, objective by objective, rather than from a course recorded last year. The outline now names data lake tiers, SOC optimization, Sentinel Graph, KQL jobs, summary rules and notebooks, so older material will have gaps. See exam changes for how to track outline updates.

Practice assessment and sandbox

SC-200 has a free official practice assessment on Microsoft Learn. Take it once early to find your weakest domain and once late to confirm readiness. The exam sandbox shows the interface and question types without testing any content.

Question types

Expect the usual Microsoft mix: single and multiple-answer multiple choice, drag-and-drop ordering, dropdown completion of KQL queries, yes/no statement series, and case studies where several questions share one scenario. Microsoft notes the exam may have interactive components.

Because the role works with queries all day, expect to read KQL and complete missing operators or table names, not just pick a product name.

The passing score is scaled

700 of 1000 is not 70% correct. Microsoft scales scores and weights questions differently and does not publish the conversion. Aim for a consistent 80% or more on realistic practice material.

Time management

100 minutes is enough if you do not get stuck. KQL questions and case studies take the longest. Read the query line by line, note what each operator does to the rows, and move on if a question needs more than a couple of minutes. Preview features can appear if they are commonly used, so use current documentation.

Languages, retakes and renewal

If the exam is not available in your preferred language, you can request an additional 30 minutes; arrange this before booking. If you fail, you can retake after 24 hours; later attempts need 14 days between them, with at most five attempts in 12 months, under Microsoft’s retake policy. The certification is valid for 12 months and renews through a free online assessment on Microsoft Learn. Register with a personal Microsoft account, because records tied to a work account can be lost if you leave the organisation.

For the day itself, see the exam day guide and certification costs.