Microsoft Security Operations Analyst (SC-200) Exam Prep

What's inside

1. Level 1: SC-200 Orientation and How the Questions WorkFree
   [Exam orientation] Covers what the course is and how the exam asks questions. Microsoft owns the SC-200 study guide, and it is free on Microsoft Learn; this course does not reproduce it. Check Microsoft's exam page for length, price and languages. The course is independent of Microsoft and not endorsed by it, and no pass is promised. The level maps the three weighted sections (40–45%, 35–40%, 20–25%) and the 700 pass score onto the 49 levels, and practises the recognition, product-contrast and scenario 'best answer' question styles.
2. Level 2: Defender XDR Email NotificationsFree
   [Manage a security operations environment – Configure automation] Teaches how to set up email notifications in Microsoft Defender XDR for incidents, actions and threat analytics, and when each type is the right way to tell people about a problem.
3. Level 3: Alert Tuning, Suppression and Correlation in XDR
   [Manage a security operations environment – Configure automation] Covers alert notifications in Defender XDR, including tuning, suppression and correlation: how alert tuning rules hide or resolve known-benign alerts, and how XDR correlates alerts into incidents.
4. Level 4: Defender for Endpoint Advanced Features
   [Manage a security operations environment – Configure automation] Walks through Settings > Endpoints > Advanced features in Microsoft Defender for Endpoint. For each toggle that changes response and investigation capability (for example, live response, automatically resolving alerts, tamper protection, EDR in block mode and integrations with other Defender services), it shows what the toggle enables and what depends on it.
5. Level 5: Defender for Endpoint Rules Settings
   [Manage a security operations environment – Configure automation] Covers the rules settings in Defender for Endpoint: alert suppression rules, indicators (file hash, IP, URL/domain and certificate), web content filtering, automation folder exclusions and asset rule management, with notes on when each one is the right lever.
6. Level 6: Custom Data Collection in Defender for Endpoint
   [Manage a security operations environment – Configure automation] Teaches custom data collection in Defender for Endpoint. Rule-based filters capture endpoint events beyond the default telemetry and send them to a connected Microsoft Sentinel workspace, in tables such as DeviceCustomProcessEvents, DeviceCustomFileEvents and DeviceCustomNetworkEvents.
7. Level 7: Defender for Endpoint Security Policies and ASR Rules
   [Manage a security operations environment – Configure automation] Covers configuring security policies for Defender for Endpoint, focusing on attack surface reduction (ASR) rules: audit versus block versus warn modes, exclusions, deployment through endpoint security policies, and reading ASR events.
8. Level 8: Device Groups, Permissions and Automation Levels
   [Manage a security operations environment – Configure automation] Teaches how to create and manage device groups in Defender for Endpoint, how to assign permissions with role-based access, and how to set automation levels from no automated response to full remediation, per group.
9. Level 9: Automated Investigation and Response (AIR)
   [Manage a security operations environment – Configure automation] Covers how to manage automated investigation and response in Defender XDR: what starts an investigation, how the Action center shows pending and completed remediation actions, and how to approve, reject or undo them.
10. Level 10: Configuring Automatic Attack Disruption
    [Manage a security operations environment – Configure automation] Teaches how to configure automatic attack disruption in Defender XDR: its prerequisites across the Defender workloads, the containment actions it takes (such as containing devices and users or disabling accounts), and how to exclude critical assets.
11. Level 11: Sentinel Automation Rules and Playbooks
    [Manage a security operations environment – Configure automation] Covers how to create and configure Microsoft Sentinel automation rules (triggers, conditions, ordering, expiry) and Microsoft Sentinel playbooks built on Azure Logic Apps, including permissions and when to use each.
12. Level 12: Microsoft Sentinel Roles
    [Manage a security operations environment – Configure the Sentinel SIEM and platform] Teaches how to specify Microsoft Sentinel roles (Reader, Responder, Contributor, Playbook Operator, Automation Contributor) along with related Azure and Logic Apps roles, applying least privilege for a SOC working in the unified Defender portal.
13. Level 13: Data Retention: Analytics, Data Lake and XDR Tiers
    [Manage a security operations environment – Configure the Sentinel SIEM and platform] Covers how to manage data retention for XDR and Microsoft Sentinel tables across the Analytics, Data lake and XDR tiers, with the cost and query trade-offs of each tier.
14. Level 14: Workbooks and SOC Optimization
    [Manage a security operations environment – Configure the Sentinel SIEM and platform] Teaches how to create and configure Microsoft Sentinel workbooks from templates and from scratch with KQL. It also covers how to optimize the platform with SOC optimization recommendations for data value, cost and threat coverage.
15. Level 15: Data Connectors and Windows Security Events via AMA
    [Manage a security operations environment – Ingest data] Covers how to select data connectors based on data source requirements, including Windows logs and security events. It then shows how to configure Windows Security Events via AMA with data collection rules, including event sets and custom XPath filters.
16. Level 16: Windows Event Forwarding (WEF) Collection
    [Manage a security operations environment – Ingest data] Teaches how to plan and configure collection of Windows Security events with Windows Event Forwarding (WEF). It covers subscriptions, collector design, the Windows Forwarded Events connector, and when WEF beats installing an agent on every host.
17. Level 17: Syslog via AMA and CEF via AMA
    [Manage a security operations environment – Ingest data] Covers how to plan and configure the Syslog via AMA and Common Event Format (CEF) via AMA connectors: the Linux log forwarder, the facility and severity settings in DCRs, avoiding duplicate ingestion, and the Syslog and CommonSecurityLog tables.
18. Level 18: Azure Activity Logs via Policy and Diagnostics
    [Manage a security operations environment – Ingest data] Teaches how to configure collection of Azure activity logs and resource logs by using Azure Policy and resource diagnostic settings, so that Azure sources reach the Sentinel workspace at scale.
19. Level 19: Threat Indicators and Custom Log Tables
    [Manage a security operations environment – Ingest data] Covers how to ingest threat indicators into Microsoft Sentinel (threat intelligence connectors such as TAXII and the upload API, and Defender Threat Intelligence) and how to create custom log tables in the workspace to store ingested data with the Logs ingestion API and DCRs.
20. Level 20: Defender XDR Custom Detection Rules
    [Manage a security operations environment – Configure detections] Teaches how to create custom detection rules from Advanced Hunting queries in Microsoft Defender XDR, covering the required columns, frequency, entity mapping and automated actions, and how to manage those rules over time by editing, monitoring runs and turning them off.
21. Level 21: MITRE ATT&CK Coverage and Sentinel Anomalies
    [Manage a security operations environment – Configure detections] Learners analyse attack vector coverage with the MITRE ATT&CK matrix in Microsoft Sentinel, then configure anomalies: when to duplicate and tune an anomaly rule, and how to switch it between flighting and production.
22. Level 22: Defender for Office 365 Investigation and Remediation
    [Respond to security incidents – Respond to alerts and incidents in Microsoft Defender XDR] Learners investigate and remediate email threats by using Microsoft Defender for Office 365, including Threat Explorer, email entity pages, Action center approvals and automatic attack disruption for BEC and AiTM attacks.
23. Level 23: Threats and Compromised Entities from Microsoft Purview
    [Respond to security incidents – Respond to alerts and incidents in Microsoft Defender XDR] Learners investigate and remediate threats or compromised entities identified by Microsoft Purview, such as data loss prevention and Insider Risk Management alerts that appear in the Defender XDR incident queue.
24. Level 24: Defender for Cloud Workload Protection Alerts
    [Respond to security incidents – Respond to alerts and incidents in Microsoft Defender XDR] Learners investigate and remediate alerts and incidents identified by Microsoft Defender for Cloud workload protections (servers, storage, SQL, containers and Key Vault) as they surface in Defender XDR.
25. Level 25: Defender for Cloud Apps Risk Investigation
    [Respond to security incidents – Respond to alerts and incidents in Microsoft Defender XDR] Learners investigate and remediate security risks identified by Microsoft Defender for Cloud Apps, including anomaly detections, risky OAuth apps, app governance alerts and governance actions.
26. Level 26: Compromised Identities from Microsoft Entra ID
    [Respond to security incidents – Respond to alerts and incidents in Microsoft Defender XDR] Learners investigate and remediate compromised identities identified by Microsoft Entra ID Protection by using risky users, risky sign-ins, risk detections and sign-in logs.
27. Level 27: Defender for Identity Security Alerts
    [Respond to security incidents – Respond to alerts and incidents in Microsoft Defender XDR] Learners investigate and remediate Microsoft Defender for Identity alerts covering reconnaissance, credential access and lateral movement on on-premises Active Directory, including lateral movement paths.
28. Level 28: Microsoft Sentinel Incidents in the Defender Portal
    [Respond to security incidents – Respond to alerts and incidents in Microsoft Defender XDR] Learners investigate and remediate alerts and incidents identified by Microsoft Sentinel in the unified Defender portal, covering entity mapping, raw events, playbooks run on demand and closing incidents with a classification.
29. Level 29: Agentic AI and Embedded Security Copilot
    [Respond to security incidents – Respond to alerts and incidents in Microsoft Defender XDR] Learners investigate incidents by using agentic AI, including embedded Microsoft Security Copilot incident summaries, guided responses, script analysis and natural-language-to-KQL, and they learn to check what the AI produces.
30. Level 30: Multi-Stage, Multi-Domain and Lateral Movement Attacks
    [Respond to security incidents – Respond to alerts and incidents in Microsoft Defender XDR] Learners investigate complex attacks that cross email, identity, endpoint and cloud by using the attack story, the incident graph and correlated alerts to reconstruct lateral movement.
31. Level 31: Case Management in the Defender Portal
    [Respond to security incidents – Respond to alerts and incidents in Microsoft Defender XDR] Learners manage security incidents by using case management in the Defender portal: they create cases, link incidents, assign owners and tasks, and record notes and decisions for audit.
32. Level 32: Investigating Defender for Endpoint Device Timelines
    [Respond to security incidents – Respond to alerts and incidents in Microsoft Defender for Endpoint] Learners investigate device timelines by filtering events, marking events, pivoting to process trees and exporting timelines to rebuild what happened on a device.
33. Level 33: Device Response Actions and Investigation Packages
    [Respond to security incidents – Respond to alerts and incidents in Microsoft Defender for Endpoint] Learners perform actions on the device, including isolating it, restricting app execution, running an antivirus scan, starting an automated investigation and collecting an investigation package.
34. Level 34: Live Response Sessions on Endpoints
    [Respond to security incidents – Respond to alerts and incidents in Microsoft Defender for Endpoint] Learners perform live response on a device: they start a session, use basic and advanced commands, upload and run scripts from the library, and collect files, all within the permissions and advanced features that live response requires.
35. Level 35: Evidence and Entity Investigation
    [Respond to security incidents – Respond to alerts and incidents in Microsoft Defender for Endpoint] Learners perform evidence and entity investigation on file, IP, URL, user and device pages, and use verdicts, prevalence and indicators to remediate across the estate.
36. Level 36: Incidents Contained by Automatic Attack Disruption
    [Respond to security incidents – Respond to alerts and incidents in Microsoft Defender for Endpoint] Learners investigate and remediate incidents identified by automatic attack disruption: they recognise the disruption tag, review contained devices and users, and decide when to release containment.
37. Level 37: Investigating Threats with Microsoft Purview Audit
    [Respond to security incidents – Investigate Microsoft 365 activities to identify threats] Learners investigate threats by using Microsoft Purview Audit: they search audit logs in the portal and with PowerShell, and use Audit (Premium) events such as MailItemsAccessed to scope a compromise.
38. Level 38: eDiscovery Content Search and Graph Activity Logs
    [Respond to security incidents – Investigate Microsoft 365 activities to identify threats] Learners investigate threats by using Content search in Microsoft Purview eDiscovery to locate and purge malicious content, and by using Microsoft Graph activity logs to trace suspicious API calls made by apps and users.
39. Level 39: Choosing the Right Advanced Hunting Table
    [Perform threat hunting – Detect threats by using Microsoft Defender XDR] Learners identify the appropriate table to use in a KQL query by mapping questions to the Advanced Hunting schema's Device, Email, Identity, CloudApp and Alert tables, and to Sentinel tables.
40. Level 40: Identifying Threats with KQL
    [Perform threat hunting – Detect threats by using Microsoft Defender XDR] Learners identify threats by using Kusto Query Language (KQL), writing threat-focused queries with where, project, extend, summarize, join, let and parse.
41. Level 41: Building Advanced Hunting Queries in Defender XDR
    [Perform threat hunting] Covers the guide's item 'Create Advanced Hunting queries': you write multi-table Advanced Hunting queries in the Defender portal that join Device*, Email*, Identity* and CloudAppEvents data, then save, share and tune them so they return the columns a detection or investigation needs.
42. Level 42: Interpreting Threat Analytics in Defender XDR
    [Perform threat hunting] Covers the guide's item 'Interpret threat analytics in Microsoft Defender XDR': you read a threat analytics report, from its overview and analyst report to related incidents, impacted assets, exposure and recommended actions, and turn its hunting queries into checks on your own tenant.
43. Level 43: Hunting Graphs and Blast Radius Analysis
    [Perform threat hunting] Covers the guide's item 'Create hunting graphs, including blast radius': you use the hunting graph in the Defender portal to follow relationships between users, devices and other entities toward critical assets, and use the incident graph's blast radius analysis to see the vulnerable paths an attacker could take from a compromised entity.
44. Level 44: Entity Relationships with Sentinel Graph
    [Perform threat hunting] Covers the guide's item 'Analyze relationships between entities by using Sentinel Graph': you learn how Sentinel graph models assets, identities, activities and threat intelligence as connected nodes, and how its graph experiences and graph tools (blast radius, path discovery, exposure perimeter) expose relationships that flat tables hide.
45. Level 45: Creating and Monitoring Sentinel Hunting Queries
    [Perform threat hunting] Covers the guide's item 'Create and monitor hunting queries': you work in the Hunting page of Microsoft Sentinel in the Defender portal to run built-in and custom queries mapped to MITRE ATT&CK, monitor results with livestream, save evidence as bookmarks, and manage hunts.
46. Level 46: KQL Jobs in the Sentinel Data Lake
    [Perform threat hunting] Covers the guide's item 'Create and manage KQL jobs in Data lake': you write one-time and scheduled KQL jobs over data lake and federated tables for long-running investigations, historical threat intelligence matching and aggregation, and send the results into a table you can query from the analytics tier.
47. Level 47: Summary Rule Tables for Querying
    [Perform threat hunting] Covers the guide's item 'Create and manage Summary rule tables for querying': you set up Sentinel summary rules that aggregate high-volume logs on a schedule into custom tables, then query those tables for detection, hunting and historical investigation at lower cost.
48. Level 48: Hunting with Notebooks and the Sentinel MCP Server
    [Perform threat hunting] Covers the guide's item 'Hunt for threats by using Notebooks, including connection to the Sentinel MCP Server': you run Jupyter notebooks against the Sentinel data lake for analysis that KQL alone can't handle, and connect AI tools to Sentinel data through the Sentinel MCP Server to explore tables and build queries.
49. Level 49: Timed Mock Exam: SC-200 (50 Questions, 100 Minutes) Timed mock
    [All sections] A timed mock exam of 50 original scenario questions across Manage a security operations environment, Respond to security incidents and Perform threat hunting, weighted like the study guide, that checks you are ready to pass at 70% with every distractor explained.

Access

The first 2 levels are free with a free account. Every level, the podcast edition and the AI tutor come with All Access at £4.99/month or any Creator plan — see pricing.

Start free →