Treat KQL as a core topic.
One passer describes about ten questions built on KQL syntax, plus questions that expect you to know which columns are in common Defender and Sentinel tables.
Microsoft Certified: Security Operations Analyst Associate (SC-200) Exam Guide
Validates knowledge of security operations, incident response and threat hunting with KQL using Microsoft Sentinel and Defender XDR.
SC-200 tests whether you can run security operations in Microsoft Sentinel and Defender XDR. Set up a lab workspace, learn where each alert and log lives, and write KQL until you can find the right table and filter without guessing.
Understand the exam
Syllabus
Manage a security operations environment40–45%
- Configure automation for Microsoft Defender XDR and Microsoft Sentinel
- Configure the Microsoft Sentinel SIEM and platform
- Ingest data into the Microsoft Sentinel SIEM and platform
- Configure detections
Example scenario: Windows servers must send only selected security events to Sentinel. Which connector and data collection setup would you use?
Respond to security incidents35–40%
- Respond to alerts and incidents in Microsoft Defender XDR
- Respond to alerts and incidents in Microsoft Defender for Endpoint
- Investigate Microsoft 365 activities to identify threats
Example scenario: A user reports a phishing email and Defender shows the same message in 40 mailboxes. What would you investigate and remediate first?
Perform threat hunting20–25%
- Detect threats by using Microsoft Defender XDR
- Detect threats by using the Microsoft Sentinel platform
Example scenario: You suspect an attacker used a stolen account to sign in to several devices last week. Which tables would your KQL query join?
Official SC-200 study guide · Skills measured as of October 21, 2026
Format
- Questions
- 40–60
- Duration
- 100 min
- Passing score
- 700 / 1000
- Delivery
- Test centre or online
- Languages
- English, Japanese, Chinese (Simplified), Korean, French, German, Spanish, Portuguese, Chinese (Traditional), Italian
Question types
Choose the best answer from the options, or the stated number of answers when a question asks for more than one.
CertUp example
A security analyst wants Microsoft Sentinel to run a response workflow automatically when a high-severity incident is created. What should they create?
Show answer
A. An automation rule triggers on incident creation and can run a playbook. Workbooks, watchlists and bookmarks do not start responses.
Drag items from a list into the matching places; an item can be used once, more than once or not at all.
CertUp example
Drag each log source to the connector used to collect it into Sentinel. The sources are Windows security events, Linux syslog messages, and CEF messages from a firewall.
Show answer
Windows security events → Windows Security Events via AMA, Linux syslog messages → Syslog via AMA, firewall CEF messages → Common Event Format (CEF) via AMA.
Pick one value from each drop-down list in a block of text or a diagram to complete it.
CertUp example
Complete the KQL query. To find failed sign-ins in the last day, query the [SigninLogs / DeviceProcessEvents] table and filter on [TimeGenerated > ago(1d) / TimeGenerated < ago(1d)].
Show answer
SigninLogs, and TimeGenerated > ago(1d). Sign-in records are in SigninLogs, and greater than ago(1d) keeps only the last 24 hours.
Read a description of a fictional company, then answer several questions that share the same background.
CertUp example
Fabrikam uses Defender for Endpoint on all laptops and Sentinel for its SIEM. It needs an alert when a user signs in from two countries within an hour. Which Sentinel feature should you configure?
Show answer
A. A scheduled analytics rule runs a KQL query on a schedule and creates an alert when its condition is met.
Eligibility and booking
Sign in to Microsoft Learn with a personal Microsoft account, then schedule SC-200 with Pearson VUE from the exam page.
Make a study plan
Read the skills list and take the free practice assessment. Then work through one course while you build a small Sentinel and Defender lab and write KQL every week.
Most candidates spend 25–80 hours. Plan for the low end if you use Sentinel or Defender every day; add time if KQL or security operations are new to you.
- 1Understand the examRead the syllabus and format, check you’re eligible and pick a target date.3 h
- 3Learn the core conceptsWork through one main course or book, topic by topic.36 h
- 4Practice with mock examsTake timed practice tests and review every mistake.18 h
- 5Prepare for exam dayBook the exam and check the ID and delivery rules.3 h
Learn the core concepts
Use one course for coverage and practise KQL often. The hunting questions expect you to know the tables and operators.
Best free courseSC-200 course on Microsoft Learn
Best paid courseSC-200 Microsoft Security Operations Analyst Course & SIMs
Best subscriptionMicrosoft Security Operations Analyst (SC-200)Watch your lab costs. Sentinel charges for ingested data. Use a small workspace, connect only the data you need and delete it when you finish.
Practice with mock exams
Take Microsoft's free practice assessment first, then a fuller question bank. Look up the Learn page for each miss so you can find it quickly in the exam.
Best free checkSC-200 Practice Assessment
Best valueSC-200 Practice Exams
Official practice partnerSC-200 Official Practice TestAre you ready?
- You can name the right Defender or Sentinel table for a hunting question.
- You can write a KQL query that filters, summarizes and joins two tables.
- You can choose between an automation rule, a playbook and a detection rule for a requirement.
Prepare for exam day
Choose the checklist for your test-centre or online appointment.
Before going to the test centre
Before testing from home
- Bring a current government-issued ID whose name matches your certification profile.
- Arrive about 15 minutes early for check-in.
- Store your belongings as instructed.
- Run the OnVUE system test on the same computer, network and room.
- Use a private room with the door closed and a clear desk. Unplug extra monitors.
- Check in from 30 minutes before your appointment. Check-in takes about 15 minutes.
- Keep your phone out of reach but nearby for check-in photos.
- Leave time for the case study. Once you leave it, you cannot return.
- Use Microsoft Learn to confirm a detail, not to learn a topic. The clock keeps running.
Advice from exam takers
Save time for the case study.
Several pass reports describe running short of time in a scenario section that cannot be revisited, even with daily Sentinel experience.
Use more than one practice source.
One passer scored 50% on Microsoft's practice assessment and 85% on MeasureUp, and studied the Learn article behind every miss.