SC-200 scenarios: which study route fits
To study for SC-200 well, work out whether your gaps are in KQL, in Microsoft Sentinel and Defender configuration, or in security operations itself. The exam has three domains: Manage a security operations environment (40–45%), Respond to security incidents (35–40%) and Perform threat hunting (20–25%), and it runs 100 minutes with a passing score of 700 out of 1000. KQL appears in all three.
Example profiles, not real people. The profiles below are illustrative planning examples built from the official exam outline. They are not reviews or reports of anyone’s result.
The site’s four-week study plan starts with KQL and assumes 8 to 10 hours a week for someone who already works with Microsoft 365 security or Azure. It says to double the timeline without security operations experience. The figures below follow from that plan and the weights, and they are planning assumptions only.
The analyst who works the incident queue daily
Starting point. Triages alerts, isolates devices and closes incidents, mostly through the portal’s built-in views. Knows what lateral movement looks like and how to read a device timeline.
Where the time goes. The incident response domain (35–40%) is largely familiar, so the hours go to the largest domain, Manage a security operations environment, where the configuration objectives live: AMA data collection rules, retention across the analytics, data lake and XDR tiers, custom tables, automation rules versus playbooks, and attack surface reduction rules. Threat hunting (20–25%) needs KQL written from scratch, not clicked together.
The trap. Assuming the exam is a tier-one skills test. Analysts who operate a tool but never configured the ingestion behind it meet questions about connectors and tiers they have never had to answer.
Suggested order. KQL first, then Sentinel platform and ingestion, then detections and automation, then a short incident-response review.
Time budget. A planning assumption is two to three weeks, around 20 to 30 hours, matching the study plan’s advice to compress weeks 3 and 4 and spend the savings on configuration and KQL.
The Microsoft 365 or Azure administrator moving toward security
Starting point. Knows tenants, roles, Log Analytics workspaces and Logic Apps, and has set up connectors and policies. Has reacted to alerts occasionally but has not run an investigation end to end or written hunting queries.
Where the time goes. The environment domain is the comfortable one, because workspaces, role-based access and diagnostic settings are daily work. The real study time goes to Respond to security incidents (35–40%): investigating across Defender for Office 365, Identity, Cloud Apps and Entra ID alerts, live response and investigation packages, and Purview Audit and eDiscovery searches. KQL fills the rest.
The trap. Over-investing in setup because it feels productive. Configuration is the largest domain, but an administrator can reach for it too long and arrive at the exam without having practised a single multi-stage incident.
Suggested order. KQL, then incident response, then detections and automation, with the platform and ingestion week as a verification pass.
Time budget. A planning assumption is the standard four weeks, 32 to 40 hours, with the KQL and incident weeks given the most hands-on lab time.
The help desk or IT generalist changing into security
Starting point. Understands accounts, devices and tickets, but not attack stages, a SIEM or a query language. The official familiarity list (Microsoft security, compliance and identity solutions, Microsoft 365, Azure, AI agents and Copilots, and Windows, Linux and mobile operating systems) is partly new.
Where the time goes. Everything, in a particular sequence: vocabulary first (alert versus incident versus detection), then KQL, then the products. The weights still decide the budget: just over four tenths on the environment, close to four tenths on incident response, about a fifth on hunting.
The trap. Memorising product names without ever running a query. The exam asks for completed KQL, so a candidate who can list the tools but cannot read a summarize and join pipeline is exposed.
Suggested order. Fundamentals (the SC-900 guide is an option, not a requirement), then KQL, ingestion, incidents and detections.
Time budget. A planning assumption is eight weeks at 8 to 10 hours, 64 to 80 hours, following the plan’s “double the timeline” advice.
Comparing the three SC-200 routes
| Profile | Front-loaded | Main risk |
|---|---|---|
| Incident-queue analyst | KQL, ingestion, retention tiers, automation | Configuration questions on tools only operated |
| Microsoft 365 or Azure administrator | KQL, multi-product incident response | Over-studying setup, under-practising investigation |
| Help desk career changer | Vocabulary, then KQL | Product names without query skill |
How to check which SC-200 route fits before booking
Take the free official practice assessment cold and note which of the three domains is lowest. Then check the prerequisites page self-check: if you cannot read a short filter-and-count query, start with KQL. Use the sample questions, the practice test and the exam format page, which covers the October 21, 2026 English update.
If your work is closer to cloud engineering than to a SOC, SC-500 is the neighbouring exam.