SC-200 — Microsoft Security Operations Analyst

• SC-200 role, exam structure and security operations lifecycle
• Microsoft Defender XDR and Microsoft Sentinel unified experience
• How Entra ID, Purview, Defender for Cloud and third-party security data fit together
• Alert, incident, entity, evidence and case-management relationships

• Workspace and platform architecture, permissions and least-privilege roles
• Data connectors for Microsoft, Windows, Linux, CEF/Syslog and third-party sources
• Analytics, Data Lake and XDR table tiers; retention and cost decisions
• Multi-workspace, multi-tenant and SOC operating patterns

• Email notifications for incidents, actions and threat analytics
• Alert tuning, suppression and correlation
• Automated investigation and response (AIR)
• Automatic attack disruption and remediation review

• Advanced features and rules settings
• Custom data collection and endpoint telemetry
• Security policies and attack surface reduction (ASR) rules
• Device groups, permissions and automation levels

• Automation rule triggers, conditions, ordering and expiry
• Incident, alert and entity-triggered playbooks
• Logic Apps permissions, managed identities and connector security
• Automations such as enrichment, owner assignment, user disablement and IP blocking

• Build operational workbooks with parameters, queries and drill-downs
• Apply SOC optimization recommendations
• Analyze attack-vector coverage with the MITRE ATT&CK matrix
• Configure, validate and tune Sentinel anomalies

• Severity, confidence, evidence and entity-driven triage
• Incident ownership, tasks, comments, tags and service-level targets
• False-positive classification and detection feedback loops
• Case management, escalation and defensible investigation notes

• Investigate multi-stage, multi-domain and lateral-movement attacks
• Correlate identity, endpoint, email, application and cloud evidence
• Use incident story, attack timeline and threat analytics
• Investigate with embedded Security Copilot and agentic AI

• Device timeline analysis and process-tree investigation
• Evidence and entity investigation
• Live response, device isolation and investigation-package collection
• Validate and remediate incidents identified by automatic attack disruption

• Phishing, malicious links, attachments and mailbox remediation
• Defender for Office 365 investigation and automatic attack disruption
• Purview Audit and Content Search for activity investigation
• Microsoft Graph activity logs and compromised-entity evidence

• Compromised identities and risky activity in Microsoft Entra ID
• Defender for Identity alerts and lateral-movement evidence
• Defender for Cloud Apps investigations and session controls
• Defender for Cloud workload-protection alerts across cloud resources

• Investigate incidents, alerts, entities and timelines in Sentinel
• Use investigation graphs, bookmarks and hunting evidence
• Run automation rules and playbooks safely during response
• Close incidents with evidence, classification and lessons learned

• Select the right Defender XDR and Sentinel table
• Use where, project, extend, summarize, parse, join and union
• Work with time windows, dynamic fields, arrays and entity identifiers
• Turn investigation questions into efficient, readable KQL

• Create Defender XDR advanced hunting queries
• Convert hunting logic into custom detections
• Interpret and operationalize threat analytics
• Build reusable queries for identity, endpoint, email and cloud attack patterns

• Create, run and monitor Sentinel hunting queries
• Create KQL jobs in the Sentinel Data Lake
• Create and manage summary-rule tables for repeatable analysis
• Use hunting bookmarks to carry evidence into investigations

• Create hunting graphs and analyze attack blast radius
• Use Sentinel Graph to analyze relationships between entities
• Hunt with notebooks and connect to the Sentinel MCP Server
• Use Copilot responsibly, validate AI output and protect investigation data
• Blueprint revision, scenario practice, mock assessment and exam strategy

Yes. It maps to the skills measured from 16 April 2026 and shows the current three-domain weighting. We re-check Microsoft's official guide before each batch.

Yes. SC-200 is now broader than a Sentinel-only course. The modules connect Defender XDR, Defender for Endpoint, Sentinel, Entra ID, Purview, Microsoft 365 and cloud workload investigations.

No. KQL begins with choosing tables and core operators, then progresses to advanced hunting, detections, Data Lake jobs and investigation queries.

No training provider can guarantee an exam result. The course teaches the current objectives and provides labs and exam practice; candidates must book and pass Microsoft's SC-200 exam separately.

Yes. Use the “Download Syllabus PDF” button and choose “Save as PDF” in the browser print dialog.