SC-200 Exam Guide: Skills, KQL Practice and Study Plan

The SC-200 exam proves you can work as a security operations analyst on Microsoft tools. You get 100 minutes, you need 700 or more to pass, and Microsoft lists the price at $165.00 USD. Our voucher costs $44.99.

What SC-200 proves and who should take it

Passing earns you Microsoft Certified: Security Operations Analyst Associate. Microsoft rates it Intermediate, with Azure as the product and Security Operations Analyst as the role.

Candidates reduce risk by performing triage, responding to incidents, hunting for threats, and engineering detections. You do this with Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra ID, Microsoft Purview, and Microsoft Defender for Cloud workload protections. You hunt with KQL and automate responses.

It suits SOC analysts, junior incident responders, and admins moving into security. Microsoft says you should be familiar with:

• Microsoft security, compliance, and identity solutions

• Microsoft 365

• Azure cloud services

• AI agents and Copilots

• Windows, Linux, and mobile operating systems

Skills measured and weights

These weights come from the official study guide, skills measured as of October 21, 2026.

The biggest area is setup, not incident response. Some candidates expect a pure investigation exam and under-study configuration.

Expect tasks like these from the study guide:

• Configure attack surface reduction (ASR) rules in Microsoft Defender for Endpoint.

• Create Microsoft Sentinel automation rules and playbooks.

• Configure Windows Security Events via AMA, including data collection rules.

• Plan Syslog via AMA and Common Event Format (CEF) via AMA connectors.

• Manage analytics rules: scheduled, near-real time (NRT), threat intelligence, and machine learning.

• Analyze attack vector coverage with the MITRE ATT&CK matrix.

• Use device timelines, live response, and investigation packages.

Microsoft notes that the bullets illustrate how skills are assessed, and related topics may appear. Preview features can show up if they are commonly used. English exams are updated first, and other languages follow about eight weeks later.

Exam format at a glance

Plan your pacing around the 100 minutes. Interactive components can take longer than standard questions.

Price, voucher validity and refund terms

Microsoft says the price depends on the country or region where you take the exam. Check your local price on the official page before you compare.

Our SC-200 voucher is valid for 12 months and is redeemed with Pearson VUE.

Here is how delivery and refunds work:

1. We email the voucher code within 12 hours of payment. It also appears in your account.

2. You can cancel for a full refund before delivery.

3. A delivered code is non-refundable, unless Pearson VUE rejects it as invalid, already used, or expired on first use.

4. In that case, contact support within 14 days with your order number and a screenshot. We replace or refund the code.

Full terms are on the refund page and the delivery page.

A 6-week study plan at 8 hours a week

This plan totals about 48 hours. Setup gets three weeks, incident response gets one, hunting gets one, and week 6 is review. That order follows the weights: setup is the largest area. If KQL is new to you, add 2 to 3 hours a week.

Use a test tenant and an Azure subscription so you click through each setting yourself. Reading about a data collection rule is not the same as building one.

Microsoft offers an exam sandbox so you can try the question types in the real interface. Do it in week 6, not on exam day.

Worked example: two KQL queries to practice

Hunting is 20–25% of the exam, and KQL also drives detections in the setup area. Start with failed Windows sign-ins in Microsoft Sentinel. This assumes you connected Windows Security Events via AMA.

SecurityEvent
| where EventID == 4625
| summarize Failures = count() by Account, IpAddress, bin(TimeGenerated, 1h)
| where Failures > 10
| order by Failures desc

The same idea in Microsoft Defender XDR advanced hunting uses a different table:

DeviceLogonEvents
| where Timestamp > ago(7d) and ActionType == 'LogonFailed'
| summarize Attempts = count() by DeviceName, AccountName, RemoteIP
| where Attempts > 10
| order by Attempts desc

Now turn the first query into a scheduled analytics rule. Set the query frequency, map Account and IpAddress as entities, and attach a playbook. Then turn the second into a custom detection rule from advanced hunting. That one exercise touches ingestion, detections, automation, and hunting.

Common mistakes

• Skipping configuration. Setup is 40–45% of the exam. Build connectors, rules, and playbooks by hand.

• Reading KQL instead of writing it. Type queries daily and change the thresholds and time ranges.

• Using old material. The skills list was updated on October 21, 2026. Microsoft says legacy Practice Assessments on Learn are no longer updated.

• Memorizing exam dumps. Dumps are commonly outdated and can teach wrong answers. They also do not build the skills the interactive parts test.

• Studying one product at a time. Real incidents cross Defender XDR, Sentinel, Entra ID, and cloud workloads. The skills list includes complex multi-stage, multi-domain, and lateral movement attacks.

• Leaving pacing untested. With 100 minutes, practice answering fast and flagging hard items.

After you pass: renewal and next steps

The certification renews every 12 months. You renew at no cost by passing an online assessment on Microsoft Learn, so set a calendar reminder a few months ahead.

To keep your skills current, read how real flaws are exploited and patched. Our November 2026 Patch Tuesday write-up is a good start. For related certifications, browse our Cybersecurity category.

Ready to book? Get the SC-200 voucher for $44.99 and schedule through Pearson VUE.

Sources

• Microsoft Certified: Security Operations Analyst Associate

• Study guide for Exam SC-200: Microsoft Security Operations Analyst