SC-200 study resources
The best SC-200 resources are free: Microsoft’s study guide, the official practice assessment, the product documentation for Defender XDR and Sentinel, and a lab tenant where you run queries and build rules. Add realistic practice questions to find your weak domain. Be careful with outdated material: the English outline changes on October 21, 2026, and the current one names data lake tiers, SOC optimization, Sentinel Graph, KQL jobs, summary rules and notebooks, which older courses lack.
Official material that exists
| Resource | What it gives you |
|---|---|
| Exam page on Microsoft Learn | Duration, languages, scheduling and the practice assessment link |
| Study guide | The full skills outline, change log and notes on updates |
| Free practice assessment | Questions in the style and difficulty of the exam, with a per-domain report |
| Exam sandbox | The exam interface and question types, with no real content |
| Instructor-led course SC-200T00 | Microsoft’s course description for the exam |
Read the study guide first and treat it as the checklist. Its bullets illustrate how each skill is assessed, and related topics can appear.
Documentation worth reading
- Microsoft Sentinel documentation: connectors, analytics rules, automation, hunting, data lake.
- Microsoft Defender XDR documentation: incidents, advanced hunting, custom detections, automatic attack disruption.
- KQL reference: the operators and functions in every query.
Read the pages for the objectives where your practice assessment score was lowest, not the whole library.
Lab work is the differentiator
Build these in a trial tenant and a low-cost subscription:
- Onboard Sentinel to a workspace and connect a Windows VM through AMA with a data collection rule.
- Send Syslog from a Linux VM and confirm the rows arrive.
- Write and schedule a custom detection from an advanced hunting query.
- Create an NRT analytics rule, an automation rule and a playbook.
- Generate a test alert on a lab device and work it: timeline, isolation, live response, investigation package.
- Run the same hunt in Defender advanced hunting and in Sentinel, noting the table and column differences.
Set a budget alert first, because ingestion is billed.
Worth paying for
Practice tests, for diagnosis across all three domains. The free 20-question test here is weighted like the exam. Employer-funded training helps if you are new to security operations.
What to skip
Braindumps. They breach exam terms and risk the revocation of your result, and they are useless against scenario questions that describe situations rather than recite facts.
A simple order
- Read the study guide and take the practice assessment cold.
- Follow the study plan with the labs above.
- Use the domain guides for your weak areas.
- Retake the practice assessment and the practice test, then book.