5.1. Exam Strategy
The SC-200's center of gravity is the requirement-driven scenario: a short description of an environment, a "You need to…" sentence, and a qualifier that does most of the discriminating. Read the qualifier first. Least administrative effort favors built-in features (attack disruption, AIR, Content hub templates, SOC optimization, custom detections with built-in actions) over custom playbooks and scripts. Least privilege favors the narrowest role (Sentinel Responder over Contributor, Playbook Operator over Logic App Contributor, Security Operator over Security Administrator). Minimize cost favors the data lake tier, summary rules, narrow data collection rules, and the Minimal or Common Windows event sets. When several answers would work, the qualifier picks one.
Many questions resolve with a quick identification pass before you read the options:
- Which layer? Telemetry (table choice), detection (rule type), incident (triage and response), or platform (roles, tiers, connectors).
- Which product owns the signal or the asset? Email (Defender for Office 365), on-premises AD (Defender for Identity), cloud sign-in risk (Entra ID Protection), SaaS behavior and OAuth apps (Defender for Cloud Apps), devices (Defender for Endpoint), cloud workloads (Defender for Cloud), anything else (Sentinel).
- Which tier and time window? Real-time detection needs the analytics tier; long-range history lives in the lake; advanced hunting covers 30 days of XDR data.
Time management: at 40 to 60 questions in about 100 minutes, budget roughly 90 seconds per question and bank time on recall items. Case studies front-load reading, so skim their questions first and then mine the environment and requirements tabs for only what those questions need. You can't return to a case study after leaving it, so finish the set before moving on. Use mark for review on standalone questions rather than stalling, and read the interface's warnings about sections that lock once completed.
Format-specific technique: KQL hotspots usually hinge on one of five decisions (table, time column, string operator, aggregation, or join kind), so check each blank against Phase 1.5 and 4.1. Drag-drop sequences test order: anchor prerequisites first (install the Content hub solution before configuring its connector; audit before block for ASR rules; collect the investigation package before remediating). Multi-select items grade each choice, and often pair a configure step with a permission or prerequisite step. When two answers look right, reread the stem for portal context (Defender portal onboarding changes Fusion and incident creation behavior), licensing hints (Defender for Office 365 Plan 2, Audit Premium, Entra ID P1), and who performs the action (an analyst, an automation rule, or a playbook's identity).
The night-before list: the Sentinel role matrix and the service-account permission for playbooks; analytics versus data lake tier capabilities; the AMA connector table map (SecurityEvent, WindowsEvent, CommonSecurityLog, Syslog); device group rank and automation levels; custom detection required columns and actions; NRT limits; automation rule ordering; the response-action ladder; the audit, content search, and Graph activity log distinctions; KQL jobs versus summary rules.
