Microsoft Security Operations Analyst (SC-200) Study Guide [141 Minute Read]

A First-Principles Approach to Security Operations

Welcome. This guide builds a working mental model of a modern security operations center from the ground up, so that every Defender XDR blade, Sentinel rule type, and KQL operator you meet on the SC-200 lands as the answer to a "why" you already understand. Instead of memorizing where settings live, you'll learn the reasoning that lets you pick the right product, table, rule, or response action when the exam changes the scenario.

Official Exam Objectives: SC-200 Study Guide — Microsoft Learn (skills measured as of October 21, 2026)

The SC-200 is scenario-driven. Most questions describe a SOC requirement ("You need to ensure… with the least administrative effort") and ask which configuration, query, or response action satisfies it. Expect multiple-choice, multi-select, drag-drop sequencing, hotspot items that complete KQL queries, and at least one case study. The exam typically has 40–60 questions in about 100 minutes, with a passing score of 700 out of 1000. There are no prerequisites, passing earns the Microsoft Certified: Security Operations Analyst Associate credential, and the certification renews annually through a free online assessment.

Exam Domain Weights

Configuration of the SOC platform carries the most weight, which tells you what Microsoft values: an analyst who can wire up ingestion, detections, and automation, not only one who can click through an incident. Response is a close second. Hunting is the smallest domain but the most KQL-dense, and KQL also appears inside detection and investigation questions, so the query foundations in Phase 1 pay off across all three domains.