CertifyDeckCargando contenido…
Microsoft · security
SC-200 assesses the work of a security operations analyst: configuring the operations environment with Microsoft Defender XDR and Microsoft Sentinel, ingesting data and building detections, responding to alerts and incidents in Defender XDR, Defender for Endpoint and Microsoft 365, and hunting for threats with KQL.
No registration · No credit card
Question bank updated on October 4, 2026
Defender XDR suppresses a benign alert on a device through a built-in alert tuning rule. During that time, automated investigation and response finds malicious activity tied to the alert. What is the documented outcome?
Your progress
A timed 100-minute simulation, weighted by domain.
Practice domain by domain, with no time pressure.
The official syllabus organized with summaries and progress tracking.
The CertifyDeck SC-200 practice test includes 311+ original exam questions written from the official Microsoft Certified: Security Operations Analyst Associate skills outline, each with the correct answer explained and available in English and Spanish.
Practice by domain with a free online test, take a timed 100-minute mock exam weighted like the real test and review your mistakes. Start for free, no sign-up or credit card, and try the practice test before deciding.
Official weighting per domain. Start for free, no sign-up.
Security operations analysts who perform triage, respond to incidents, hunt for threats and engineer detections in multicloud and on-premises environments. Familiarity with Microsoft security, compliance and identity solutions, Microsoft 365, Azure, AI agents and Windows, Linux and mobile operating systems helps.
SC-200 is the exam for the Security Operations Analyst Associate certification. It assesses the daily work of a security operations analyst: triage, incident response, threat hunting and detection engineering with Microsoft Defender XDR, Microsoft Sentinel, Defender for Cloud, Microsoft Entra ID and Microsoft Purview.
The outline has three blocks: manage a security operations environment (40–45%), respond to security incidents (35–40%) and perform threat hunting (20–25%). The exam lasts 100 minutes.
In the first block: automation in Defender XDR and Sentinel, automation rules and playbooks, roles, data retention, connectors, collecting Windows events and Syslog with the Azure Monitor agent, and analytics and custom detection rules. For incident response: investigating alerts from Defender for Office 365, for Endpoint, for Identity, for Cloud Apps and for Cloud, using Security Copilot and device actions.
For threat hunting, KQL is essential: knowing which table to query, reading a query and writing the common ones. The outline also includes recent features of the Sentinel data lake, KQL jobs, summary rules and hunting graphs.
With experience in a security operations center, four to six weeks is usually enough; coming from [SC-900](/certifications/sc-900) without hands-on practice, plan eight or more and set up a Sentinel test environment. Spend time every day reading and writing KQL queries.
The English version of the exam is updated on 21 October 2026 with minor changes to data ingestion; our bank already follows that version.
Official source: study guide SC-200 on Microsoft Learn
CertifyDeck is an independent study platform and is not affiliated with, endorsed by, or sponsored by Microsoft. SC-200 and its related marks belong to their respective owner.
It is associate level, but it covers many products and requires reading and writing KQL queries. Without practice in Microsoft Sentinel and Defender XDR it is considerably harder.
100 minutes, according to Microsoft's official page. The passing score is 700 out of 1000.
The English version is updated on 21 October 2026 with minor changes to the section on ingesting data into Microsoft Sentinel. Other languages are updated about eight weeks later.
Yes. The threat hunting block asks you to identify the right table, interpret queries and create advanced hunting queries, and KQL also appears in detection rules.
No. They are original questions based on Microsoft's public objectives and documentation; we do not use leaked exam content.
Microsoft sets the price per country. USD 165 list price (varies by country; confirm on Pearson VUE when booking). CertifyDeck does not sell the exam, only the preparation: you can start for free and full access is a one-off fee per certification.
You need a scaled score of 700 out of 1000. The scale does not map to a fixed percentage of correct answers, so aim for consistent results above 80% on unseen mock exams before booking.
Yes. You can start for free with no sign-up or card: SC-200 practice questions with explanations, a free online test by domain and published sample questions with answers. Full access to the whole bank and the timed mock exam is a one-off payment.
Yes. Microsoft offers SC-200 in Spanish as well as English. On CertifyDeck every question, option and explanation is available in both languages, keeping the official English terminology.
It is a good free starting point, but it is short and repeats the same items. A practice test with hundreds of original Microsoft Certified: Security Operations Analyst Associate questions, timed mock exams and practice by domain tells you where you fail and whether you keep the level under time pressure.
Start free, no card
