thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Microsoft · Cybersecurity · Associate

Microsoft Security Operations Analyst exam guide

Exam SC-200

SC-200: Microsoft Security Operations Analyst validates that you can configure and operate Microsoft Defender XDR and Microsoft Sentinel to detect, investigate, respond to and hunt threats. It is the core Microsoft credential for SOC analysts.

QuestionsSee official page
Time limit100 minutes
Passing score700 (1-1000 scale)
Exam fee$165 USD
Valid for1 years
DeliveryPearson VUE test center or online proctored

Format: Multiple choice, drag-and-drop, hot area, build list and case studies; may include labs (120 minutes if labs are included). Fee note: US price; varies by country. Student and Microsoft Learn challenge discounts sometimes available.

Who it's for

SOC analysts and security engineers working with Microsoft Defender XDR, Defender for Cloud and Microsoft Sentinel.

What the exam covers

Manage a security operations environment (40-45%)—
Respond to security incidents (35-40%)—
Perform threat hunting (20-25%)—

A dash means the vendor does not publish a weight for that domain.

Eligibility & prerequisites

Required: None

Recommended: Hands-on experience with Defender XDR and Microsoft Sentinel, KQL, and incident response processes.

Keeping it active

Role-based certifications are valid 1 year. Renew free by passing an unproctored online renewal assessment on Microsoft Learn in the 180 days before expiry; no fee and no retest required.

Skills & careers

Skills it validates

  • Configuring Sentinel workspaces, data connectors and analytics rules
  • Writing KQL queries for detection and hunting
  • Investigating incidents in the Defender XDR portal
  • Automating response with playbooks and automation rules
  • Configuring Defender for Endpoint, Identity, Office 365 and Cloud Apps
  • Using Security Copilot in investigations

Job roles

SOC AnalystSecurity Operations AnalystThreat HunterIncident ResponderDetection EngineerSecurity Engineer

Where it fits in your path

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Week 1: Read the SC-200 study guide; deploy a free Sentinel lab and a Defender trial tenant
  2. Week 2: KQL fundamentals - where, summarize, join, make-series; practice in the Log Analytics demo
  3. Week 3: Manage the SOC environment (largest domain) - connectors, analytics rules, automation rules, Defender settings and RBAC
  4. Week 4: Respond to incidents - Defender XDR investigation, device isolation, playbooks, Copilot
  5. Week 5: Threat hunting - hunting queries, bookmarks, notebooks, advanced hunting; practice assessment

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • Read KQL fluently - many questions show a query and ask what to change
  • Know the unified Defender portal and which Sentinel features are managed there
  • Distinguish automation rules (triage) from playbooks (Logic Apps actions)
  • Domain 1 is 40-45% - configuration questions outweigh pure investigation
  • The exam was updated in October 2026; use the current study guide's skills list

Key terms for this exam

All 22 terms Study with thinQcards™

Commonly confused on this exam

Frequently asked questions

How much does SC-200 cost?

$165 USD in the United States.

Is SC-200 hard?

Moderate. KQL and hands-on Sentinel/Defender experience make the biggest difference.

Does SC-200 count toward Cybersecurity Architect Expert?

Yes, Security Operations Analyst Associate is an accepted SC-100 prerequisite.

SC-200 vs CySA+?

SC-200 is Microsoft-tool specific; CySA+ is vendor-neutral and DoD-recognized. SOC analysts in Microsoft shops benefit from both.

How do I renew SC-200?

Free each year via the online renewal assessment.

Official page: learn.microsoft.com. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.