CertQuests
Why SC-200 matters: Microsoft’s security stack is now the SOC default
Microsoft has become the largest enterprise security vendor by installed base. Microsoft Sentinel, Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, and Defender for Cloud collectively protect workloads across hundreds of thousands of organizations — and the SOC analysts who monitor and respond to those alerts need a recognized credential that validates their depth in these tools specifically. SC-200 is that credential: the only Microsoft certification that measures operational security skill across the full Defender + Sentinel stack rather than architectural awareness (as AZ-500 does at a higher level) or surface-level familiarity (as SC-900 measures).
The timing matters. Organizations that consolidated their security tooling on Microsoft products during the 2020–2024 market consolidation wave are now staffing their SOC teams to operate those tools at full depth. Microsoft Security is the fastest-growing segment of Microsoft’s commercial cloud revenue — exceeding $20 billion in annual revenue as of 2025 — and the talent supply of analysts who understand Sentinel KQL queries, Defender XDR incident correlation, and Defender for Cloud security posture management consistently lags demand. SC-200 is the market signal employers use to filter for that depth. Job postings requiring SC-200 or “Microsoft Sentinel experience” grew by approximately 38% year-over-year in 2025 and continue to concentrate in financial services, healthcare, and regulated government contractors where Microsoft compliance integration drives tooling choices.
The SC-200 credential sits within Microsoft’s SC (Security) track alongside SC-100 (Cybersecurity Architect Expert), SC-300 (Identity and Access Administrator Associate), SC-400 (Information Protection and Compliance Administrator Associate), and SC-900 (Security, Compliance, and Identity Fundamentals). Within the SOC career path, SC-200 is the operational layer — it certifies the analyst who works the queue, investigates incidents, writes detection rules, and builds automation playbooks — while SC-100 certifies the architect who designs the security posture across the broader environment. Many security-focused organizations treat SC-200 as the baseline expectation for SOC analyst II and analyst III hiring, with SC-100 as the eventual target for senior architects and security leads.
Exam format and logistics
| Attribute | Detail |
|---|---|
| Credential | Microsoft Certified: Security Operations Analyst Associate |
| Exam code | SC-200 |
| Questions | ~55–65 (multiple choice, drag-and-drop, case studies) |
| Duration | 120 minutes (additional time for case studies) |
| Cost | $165 USD; significant discounts via Microsoft discounted vouchers for students and unemployed candidates |
| Passing score | 700 / 1000 (scaled) |
| Validity | 1 year — renew via free annual assessment on Microsoft Learn |
| Prerequisites | None formal; SC-900 or AZ-900 recommended; hands-on Sentinel experience strongly recommended |
| Delivery | Pearson VUE (test center or online proctored) |
| Retake policy | 24-hour wait after 1st fail; 14-day wait after 2nd fail; max 5 attempts per 12 months |
The SC-200 exam format follows Microsoft’s standard Associate-level structure: a mix of standalone multiple-choice and multiple-select questions, drag-and-drop ordering questions, and one or more case studies presented at the end of the exam. Case studies present a scenario describing an organization’s environment, then ask a series of questions based on that context — candidates cannot return to standalone questions once case study mode begins, and case studies are not individually timed. The scaled scoring model means the reported score (0–1000) does not correspond directly to a raw percentage; a 700 scaled score does not mean 70% of questions were answered correctly, as some items carry more weight than others based on their difficulty and discrimination values.
Microsoft’s annual renewal model is consistent across all role-based certifications: once per year, certified holders must pass a free online assessment on Microsoft Learn covering changes to the exam objectives from the prior 12 months. Unlike the original exam, the renewal assessment is taken at home without proctoring and focuses specifically on what has changed in the Microsoft security product set since the credential was earned. Failing the renewal assessment does not immediately revoke the badge — Microsoft provides a grace period — but the certification lapses if the renewal is not completed within the renewal window shown in the Microsoft credentials dashboard.
The three exam domains
Domain 1: Mitigate threats using Microsoft Defender XDR (25–30%)
Microsoft Defender XDR (formerly Microsoft 365 Defender) is the extended detection and response platform that correlates signals across Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Microsoft Defender for Cloud Apps into a unified incident queue. This domain tests the ability to investigate and remediate threats across all four Defender XDR products using the unified portal at security.microsoft.com. Candidates must understand how Defender XDR auto-correlates individual alerts from different products into multi-stage attack incidents, how to investigate the attack chain using the incident graph and the advanced hunting interface, and how to take remediation actions — isolating a device, disabling a compromised account, removing a malicious email — directly from the incident view.
Product-specific coverage includes: Defender for Endpoint — onboarding Windows, macOS, and Linux devices via Group Policy, Microsoft Endpoint Manager (Intune), or deployment scripts; configuring attack surface reduction rules and their audit versus block modes; using endpoint detection and response (EDR) capabilities to investigate device timelines, process trees, and file activity; and managing the vulnerability assessment data exposed through Threat and Vulnerability Management (TVM). Defender for Office 365 — configuring anti-phishing policies, Safe Attachments, and Safe Links; using Threat Explorer and Real-Time Detections to investigate email-borne threats; performing email remediation including soft delete, hard delete, and move-to-junk actions via the Microsoft 365 Defender portal. Defender for Identity — deploying sensors to Active Directory domain controllers; detecting lateral movement, Pass-the-Hash, Pass-the-Ticket, and Kerberoasting activity in the Defender for Identity timeline; and investigating identity-related alerts including reconnaissance activities, compromised credential indicators, and domain dominance techniques. Defender for Cloud Apps — connecting SaaS applications via the app connector framework; configuring session policies and access policies; using the activity log and anomaly detection policies to identify shadow IT usage, impossible travel, and mass download activity from connected applications.
Domain 2: Mitigate threats using Microsoft Sentinel (50–55%)
Microsoft Sentinel is the cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) platform that forms the operational core of the SC-200 exam. At over half the exam by weight, this domain rewards candidates who have deployed and operated Sentinel in a real or lab environment — not just those who have read documentation about it. The domain covers the full Sentinel operational lifecycle: workspace deployment, data source connection, analytics rule creation, workbook configuration, SOAR playbook development, and threat hunting using KQL.
Log ingestion and data connectors are tested at the architectural level: understanding which connectors are available (Microsoft-native connectors via diagnostic settings; community and partner connectors via the Content Hub; custom connectors via the Log Analytics API or the Azure Monitor Agent); how the Log Analytics workspace retention tiers work (interactive hot tier vs. archived cold tier); how to estimate and manage ingestion costs using the pricing calculator; and how Common Event Format (CEF) and Syslog connectors are configured for non-Microsoft data sources through the Azure Monitor Agent. KQL (Kusto Query Language) is the language of Sentinel hunting and analytics rules, and candidates must be able to write functional KQL queries: filtering with where, projecting columns with project, summarizing with summarize and count(), joining tables with join, and parsing structured data from unstructured strings using parse and extract. Common exam patterns include writing queries that detect anomalous login times, identify accounts making excessive failed authentication attempts, correlate firewall deny events with successful authentications from the same IP, and flag exfiltration indicators using summarize on data volume by user over time.
Analytics rules are the core detection mechanism in Sentinel. Candidates must understand all four rule types: Scheduled rules (KQL queries that run on a configurable schedule and generate alerts when results exceed a threshold), Near Real-Time (NRT) rules (sub-minute latency rules for high-fidelity signals), Fusion rules (Microsoft-managed multi-stage attack detection using ML correlation), and Anomaly rules (ML-based behavioral baselines). For scheduled rules specifically — the most common exam topic — candidates must know how to configure alert grouping (how multiple results from a single query run are grouped into one incident vs. separate incidents), entity mapping (how to tag IP, account, host, URL, and file entities so Sentinel can correlate across incidents), and MITRE ATT&CK tactic and technique tagging. SOAR playbooks in Sentinel are Azure Logic Apps triggered by automation rules. Candidates must understand how automation rules evaluate conditions (severity, entity type, assigned analyst) and how they trigger playbooks; how playbooks are structured as Logic App workflows with trigger, action, and condition steps; and how to configure a playbook to perform common response actions such as sending a Teams notification, creating a ServiceNow ticket, or isolating a Defender for Endpoint device via its API action.
The domain also covers threat hunting: using the Hunting experience in Sentinel to run ad-hoc KQL queries against historical data across all connected log sources; using Bookmarks to preserve interesting query results and link them to incidents; creating custom hunting queries from validated hunts and saving them as analytics rules; and understanding how MITRE ATT&CK tactics guide the hunt hypothesis. Sentinel Workbooks (based on Azure Monitor Workbooks) are tested as visualization and reporting tools: understanding how to use existing workbook templates from the Content Hub, how workbook parameters enable time range filtering, and how to create workbook sections that visualize KQL query results as tables, charts, and maps.
Domain 3: Mitigate threats using Microsoft Defender for Cloud (20–25%)
Microsoft Defender for Cloud is the cloud security posture management (CSPM) and cloud workload protection platform (CWPP) for Azure, AWS, and GCP environments. This domain tests the ability to use Defender for Cloud to assess and improve security posture, investigate threats to cloud workloads, and enforce compliance with regulatory standards. Candidates must understand the difference between the two core capabilities: Foundational CSPM (free tier — Secure Score, Security Recommendations, and basic regulatory compliance assessment) and Defender for Cloud Plans (paid plans that add workload protection alerts, vulnerability assessment, and JIT VM access for specific resource types including VMs, Storage, SQL, Containers, App Service, Key Vault, and DNS).
Secure Score is Defender for Cloud’s quantified posture metric: a percentage representing the proportion of security recommendations that have been remediated, weighted by the maximum score impact of each recommendation. Candidates must understand how to read Secure Score, how to investigate and remediate specific recommendations (for example, enabling MFA on privileged accounts, enabling disk encryption on VMs, or restricting public network access on Storage accounts), and how to exempt resources from recommendations when a compensating control exists or the recommendation is not applicable. Defender for Cloud Alerts are the threat detection layer: they are generated by the Defender plan for each enabled workload type and surface indicators such as unusual processes on a VM, access from a Tor exit node to a Storage account, a potential SQL injection attempt against an Azure SQL database, or suspicious activity from a compromised container image. Candidates must know how to investigate a Defender for Cloud alert, how to correlate alerts into an attack path using the attack path analysis feature, and how to set up alert suppression rules for known false positives. Regulatory compliance is assessed by mapping resource configuration against policy definitions for standards including Microsoft cloud security benchmark (MCSB), CIS Controls, PCI-DSS, NIST SP 800-53, ISO 27001, and SOC 2. Candidates should understand how compliance assessments are generated, what a failed control means in terms of the underlying policy definition, and how to download compliance reports for audit evidence.
SC-200 vs AZ-500: different levels of the same security stack
SC-200 — Security Operations Analyst
Operational security certification. Tests end-to-end threat detection, investigation, and response using Defender XDR, Microsoft Sentinel, and Defender for Cloud. Role: SOC analyst, threat hunter, incident responder. Focus: operating the tools, writing KQL queries, building SOAR playbooks, remediating incidents. Associate level. $165 USD.
AZ-500 — Azure Security Engineer
Engineering and architecture certification. Tests how to design and implement security controls across Azure infrastructure: identity, networking, compute, storage, and database security. Role: security engineer, cloud architect. Focus: configuring the security surface of Azure resources, not operating the SOC tooling on top of it. Associate level. $165 USD.
The two credentials complement rather than duplicate each other. AZ-500 engineers configure the defenses (network security groups, Azure Key Vault, Conditional Access policies, private endpoints) that prevent breaches; SC-200 analysts detect and respond when those defenses are tested or bypassed. Large security teams typically need both roles, and professionals who hold both credentials — with the ability to both configure Azure security controls and operate the Defender + Sentinel detection layer — command a significant salary premium over specialists in only one area. The common path is to earn SC-200 first (closer to most SOC analysts’ day job) and then pursue AZ-500 to add the engineering depth; alternatively, cloud engineers with AZ-500 who move into security operations roles add SC-200 to round out their credential set. SC-100 (Cybersecurity Architect Expert), which requires passing both AZ-500 and SC-200 or holding prior qualifying certifications, sits above both and is the end-state for security architects who bridge both disciplines.
The Microsoft security certification path from SC-900 to SC-100
Microsoft’s security certification track runs from SC-900 at the fundamentals level through multiple Associate-level credentials (SC-200, SC-300, SC-400, AZ-500) up to the SC-100 Cybersecurity Architect Expert at the expert level. SC-900 is the onboarding credential: it maps Microsoft security products to general security concepts and gives non-technical stakeholders and early-career professionals a grounded mental model of the Microsoft security portfolio. SC-900 holders who want operational roles proceed to SC-200 rather than SC-300 (which targets identity admins) or SC-400 (which targets compliance admins).
SC-200 is the natural next step for anyone working in or targeting SOC roles in organizations that run Microsoft Sentinel. The credential is especially powerful for analysts who already work with Sentinel or Defender for Endpoint and want a recognized certification to match their practical experience. After SC-200, the logical progressions are: SC-100 (Cybersecurity Architect Expert) for candidates moving into senior security architect roles; AZ-500 for candidates who want to add cloud security engineering depth alongside their SOC operations skills; or GIAC GCIH / GCIA for candidates who want vendor-neutral forensics and incident response credentials alongside their Microsoft-specific certification. Security team leads and principal engineers at large enterprises increasingly hold SC-200 + AZ-500 + SC-100 as their Microsoft-stack credential stack, supplemented by vendor-neutral certifications (CISSP, CISM) for executive credibility.
Who should pursue SC-200 in 2026
Study approach and free resources
Microsoft provides the SC-200 learning path on Microsoft Learn (learn.microsoft.com) as the primary official preparation resource — it is free, self-paced, and structured into modules that map directly to the three exam domains. The learning path includes embedded knowledge checks, step-by-step exercises, and sandbox environments where candidates can practice KQL queries, configure analytics rules, and explore Sentinel workbooks without provisioning their own Azure subscription. The Microsoft Learn sandbox is especially valuable for KQL practice: the Log Analytics demo workspace (available without a paid subscription) contains pre-populated security tables including SigninLogs, SecurityEvent, AzureActivity, and Syslog that allow candidates to run and iterate on realistic KQL queries against production-like data volumes.
For hands-on lab practice beyond the Microsoft Learn sandbox, Microsoft’s SC-200 GitHub lab repository provides step-by-step exercises for deploying a Sentinel workspace, connecting data connectors, building analytics rules, and creating automation playbooks. Microsoft also publishes the official exam skills outline (downloadable from the SC-200 exam page on Microsoft Learn) that lists every measurable skill by domain and subdomain — this document is the authoritative guide to exam scope and should be reviewed at the start of study to identify gaps. The SC-200 exam is updated quarterly to track product changes, and the exam skills outline is versioned accordingly; always download the current version rather than relying on cached or third-party summaries.
The most consistently high-difficulty areas reported by SC-200 candidates are KQL query writing (particularly multi-table joins and time-series summarization), automation rule and playbook trigger logic (understanding the order of operations when multiple automation rules match an incident), and Defender for Cloud plan scoping (which specific resource types are protected by which Defender plan, and what alerts are generated at which tier). These areas warrant deliberate practice beyond passive reading — writing KQL queries against the Log Analytics demo workspace, building test playbooks in a trial Logic Apps environment, and reviewing the Defender for Cloud pricing page to map plan coverage are all more effective than re-reading the same documentation.
KQL (Kusto Query Language) accounts for the largest share of Sentinel exam questions and is the one skill you cannot fake with surface-level knowledge. Start with the KQL quick reference on Microsoft Learn, then run queries in the Log Analytics demo workspace (accessible from the Azure portal without a subscription). Drill the five operators you will use in every query: where, project, summarize, join, and parse. The SC-200 exam will give you a scenario and ask you to select or complete a KQL query that detects it — if you have not written dozens of real queries, you will guess. If you have, these questions become the easiest on the exam.
Practice SC-200 Security Operations Analyst questions free on CertQuests.
Practice SC-200 Questions →