Updated for July 2026 Exam Objectives

SC-200 Practice Test

Microsoft Certified: Security Operations Analyst Associate

Train like a SOC analyst. Pass like one too.

Our SC-200 questions go deep on Sentinel KQL, Defender XDR incident response, and Defender for Cloud — the exact skills tested on exam day.

Start Free Practice — 40 Questions

No credit card required. Upgrade to full 500 questions for $19.99 when ready.

500 Exam-Style Questions
7-Day Money-Back Guarantee

Is this for you?

Your SC-200 exam is in the next 2-4 weeks
You've studied the concepts but aren't sure you'll pass
You want questions harder than the real exam
You want to understand why answers are correct, not just memorize

This is NOT for you if:

You're looking for braindumps or exam leaks
You haven't started studying the concepts yet
Most successful candidates start practice 2-3 weeks before their exam
Updated for the July 2026 exam blueprint

SC-200 Exam Details

What to expect on exam day

Questions

40-60 questions

Duration

120 minutes

Passing Score

700/1000

Exam Cost

$165 USD

Exam Domains Covered

Master all topics tested on the SC-200 exam

1

Manage a security operations environment (40-45%)

2

Respond to security incidents (35-40%)

3

Perform threat hunting (20-25%)

Test Yourself Right Now

Try 5 real practice questions — no signup needed

🎯

5 Free SC-200 Questions

See how ready you are for the SC-200 exam. Each question includes a detailed explanation so you learn as you go.

No account requiredTakes 2-3 minutesInstant results

Sample SC-200 Practice Questions

10 real questions from the free SC-200bank. Pick an answer in your head, then open “Show answer” for the explanation.

  1. 1. A team lead creates a new High-Value Assets device group in MDE for server devices. Analysts report they cannot see any devices in the group. What step was missed?

    • A. Enable network protection for the group
    • B. Assign the device group to a user role in the Roles configuration
    • C. Onboard devices manually to the group via a script
    • D. Configure Group Policy Objects in Active Directory
    Show answer

    Correct answer: B

    In Microsoft Defender for Endpoint, device groups must be associated with user roles. By assigning a device group to a role, you control which users can view and take actions on devices in that group within the Defender portal. Roles without a device group assignment have no device access.

  2. 2. In Microsoft Defender XDR, which automated investigation and response (AIR) setting controls whether remediation actions are executed automatically or require analyst approval?

    • A. Alert suppression rules
    • B. Automation level
    • C. Remediation threshold
    • D. Investigation priority
    Show answer

    Correct answer: B

    The automation level configured per device group in Microsoft Defender for Endpoint determines remediation behavior: Full automation executes all actions automatically, Semi-automation requires approval for some or all actions, and No automated remediation takes no action. This is configured under device group settings.

  3. 3. A junior analyst needs read-only visibility into Sentinel incidents and workbooks but must not be able to manage or modify any resources. Which role provides this?

    • A. Microsoft Sentinel Contributor
    • B. Microsoft Sentinel Automation Contributor
    • C. Microsoft Sentinel Responder
    • D. Microsoft Sentinel Reader
    Show answer

    Correct answer: D

    The Microsoft Sentinel Reader role provides read-only access to all Sentinel resources including incidents, workbooks, hunting queries, and data. It cannot manage incidents or modify any configuration. This is appropriate for stakeholders needing visibility without operational access.

  4. 4. What is the primary benefit of using Microsoft Sentinel Content Hub solutions compared to configuring individual components separately?

    • A. Content Hub reduces ingestion costs for third-party data connector logs
    • B. Content Hub solutions are designed primarily for sovereign and government cloud deployments
    • C. Content Hub solutions cannot be modified after installation and must be used as delivered
    • D. Content Hub solutions bundle related data connectors, analytics rules, workbooks, and playbooks for a specific product or use case
    Show answer

    Correct answer: D

    Content Hub solutions are packaged collections of Sentinel content - data connectors, analytics rules, hunting queries, workbooks, and playbooks - scoped to a specific product or scenario. They enable faster deployment and consistent configuration compared to installing each component individually. Content Hub does not reduce ingestion costs (option A) - pricing is based on data volume. Solutions support commercial and government clouds equally (option B). Content Hub packages can be customized after installation (option C).

  5. 5. A CISO asks for a single number representing the organization's cloud security posture across all Azure subscriptions in Defender for Cloud. Which metric should be referenced?

    • A. Threat exposure score
    • B. Secure score
    • C. Compliance percentage
    • D. Risk rating
    Show answer

    Correct answer: B

    Secure score in Microsoft Defender for Cloud quantifies the organization's security posture as a percentage. Implementing security recommendations increases the score, providing a measurable way to track security improvements over time.

Show 5 more questions

  1. 6. When configuring alert notification rules in Microsoft Defender XDR, which combination of filters can be applied to control which alerts trigger email notifications?

    • A. Alert severity as the sole filter
    • B. Device operating system as the sole filter
    • C. User department, device operating system, and sign-in location
    • D. Alert severity and device group
    Show answer

    Correct answer: D

    Alert notification rules in Defender XDR filter by alert severity and device group (D). Alert severity as the sole filter (A) is too narrow. Device operating system alone (B) is not a supported notification filter. The user department, OS, and sign-in location combination (C) is not available for alert notification rules.

  2. 7. In Microsoft Defender XDR Exposure Management, what does the "attack surface" view primarily help security teams understand?

    • A. Entry points and pathways an attacker could use to reach critical assets
    • B. Attack paths from internet-facing assets to identity systems such as Microsoft Entra ID
    • C. The devices that have failed compliance policies in Intune
    • D. Users with excessive privileged access in Entra ID
    Show answer

    Correct answer: A

    The attack surface view in Exposure Management maps potential pathways and entry points that attackers could exploit to reach critical assets. It helps teams prioritize remediation by visualizing exposure paths and choke points rather than treating vulnerabilities as isolated issues.

  3. 8. Which setting in Microsoft Defender XDR allows administrators to configure email notifications when new alerts are generated for specific device groups?

    • A. Alert notification rules
    • B. Automation level settings
    • C. Device group policies
    • D. Endpoint detection rules
    Show answer

    Correct answer: A

    Alert notification rules in Microsoft Defender XDR settings allow administrators to configure email notifications for new alerts filtered by severity, device group, and alert category. This ensures the right teams are notified about relevant threats.

  4. 9. When using the Windows Security Events via AMA data connector in Microsoft Sentinel, which component must be created to specify which events are collected from Windows machines?

    • A. Data Collection Rule (DCR)
    • B. Log Analytics saved search
    • C. Sentinel analytics rule
    • D. Automation playbook
    Show answer

    Correct answer: A

    The Windows Security Events via AMA connector requires a Data Collection Rule (DCR) specifying which Windows Security events to collect (All Events, Common, Minimal, or custom XPath queries) and which machines the rule applies to. The AMA extension on each machine enforces the DCR.

  5. 10. When configuring Windows Security Events collection via the AMA connector in Microsoft Sentinel, which preset collects the minimum events while still supporting investigation of failed logons and privilege use?

    • A. The complete Windows Security event set
    • B. Minimal
    • C. No event collection
    • D. Common
    Show answer

    Correct answer: D

    The Common preset (D) is the smallest Windows Security Events set that still includes the events needed to investigate failed logons (4625) and privilege use (4672/4673). The Minimal preset (B) is a very small audit set that does not reliably cover those. The complete event set (A) collects everything at high cost; selecting no collection (C) gathers nothing.

SC-200 study resources

Why Practice with MSCertQuiz?

Microsoft Learn teaches concepts. We prepare you for the actual exam.

1

Deep coverage of Microsoft Sentinel analytics rules, workbooks, and KQL queries

2

Realistic Defender XDR incident response scenarios you'll face on exam day

3

Defender for Cloud security posture and threat protection questions

4

Updated for the latest 2026 exam objectives — Defender XDR unified SOC platform

Aligned to Microsoft's "skills measured as of" update: July 28, 2026

Not sure if you're ready for the SC-200 exam?

Take the free SC-200 Readiness Check →

What Our Users Say

“The KQL and Sentinel analytics rule questions were exactly what I needed. I'd been struggling with hunting queries but the practice explanations made it click. Passed SC-200 with 756.”

AK

Ahmed K.

SC-200 Certified

“Working as a SOC analyst daily wasn't enough — SC-200 tests very specific configurations in Sentinel and Defender XDR. MSCertQuiz exposed the gaps in my knowledge before the real exam did.”

SR

Sarah R.

Security Operations Analyst

“The Defender for Cloud and threat hunting questions were challenging and realistic. The explanations taught me the reasoning behind each answer, not just what to memorize. First attempt pass.”

MJ

Marcus J.

Passed SC-200 first try

Choose Your Plan

Start free, upgrade when you're ready to get serious

Free

Good for exploring the platform

$0
  • 40 practice questions
  • Practice mode only
  • Progress tracking
  • No exam simulation mode
Start Free

SC-200 Full Access

Best if your exam is in the next 2-4 weeks

$19.99one-time
  • 500 practice questions
  • Practice & Exam modes
  • Detailed explanations
  • Lifetime access
Get SC-200 Access — $19.99

7-day money-back guarantee

BEST VALUE

Pro — All Certs

Best if you're planning multiple Microsoft exams

$14.99/month
  • ALL certifications included
  • Unlimited questions
  • New certs added free
  • Cancel anytime
View Pro Plans

Save 30% vs buying individually

Your SC-200Exam Won't Wait

Candidates who complete at least 2 full mock exams pass at significantly higher rates than those who only study passively.

Don't risk $165 USD on the real exam without testing yourself first.

Start Free Practice Now

No credit card required • 40 free questions • Upgrade for $19.99 when ready

Official Microsoft Resources

Our practice questions are aligned with official Microsoft exam objectives. We recommend studying with Microsoft Learn first, then using MSCertQuiz to test your readiness.

View Official SC-200 Exam Details

SC-200 Frequently Asked Questions

Everything you need to know about the SC-200 Microsoft Security Operations Analyst certification

How hard is the SC-200 exam?
SC-200 is difficult — one of the harder Microsoft Associate-level certifications because it requires KQL query writing skills that most candidates have never used before. It tests hands-on experience with Microsoft Sentinel, Defender XDR, and Defender for Cloud through scenario-based questions and case studies. Most candidates need 8–12 weeks of preparation including a dedicated KQL learning phase. Common failure points are KQL syntax (where, summarize, join, parse), Sentinel analytics rule logic, and distinguishing Defender for Endpoint detections from Defender XDR incidents.
What does SC-200 cover?
SC-200 covers three domains: managing a security operations environment (40-45% — configuring Sentinel, Defender for Endpoint automation, data ingestion, and detection rules), responding to security incidents (35-40% — investigating and remediating alerts across Defender XDR, Defender for Cloud, and Sentinel, including agentic AI investigation via Security Copilot), and performing threat hunting (20-25% — KQL-based hunting in Defender XDR and Sentinel, including the Sentinel data lake and MCP Server).
Is the SC-200 exam worth it in 2026?
Yes — Security Operations Analysts are in extremely high demand. SC-200 validates skills directly applicable to SOC roles using Microsoft's unified security platform. Salaries range from $90K to $155K. The certification demonstrates proficiency in Sentinel, Defender XDR, and Defender for Cloud — tools used by tens of thousands of organizations worldwide.
Do I need KQL knowledge for SC-200?
Yes, KQL (Kusto Query Language) knowledge is essential for SC-200. You'll need to write and interpret queries for Sentinel analytics rules, hunting queries, and workbooks. Basic KQL operators like where, summarize, extend, join, and project are frequently tested. Our practice questions include realistic KQL scenarios to build your proficiency.
How much does the SC-200 exam cost in 2026?
The SC-200 exam costs $165 USD in 2026. This is the standard Microsoft Associate-level certification price. Pricing varies by country: approximately ₹4,800 INR in India, £113 GBP in the UK, and €165 EUR in most European markets. Always confirm the current price on the official Microsoft Learn scheduling page for your region. Microsoft Ignite, Enterprise Skills Initiative (ESI), and Microsoft Learn Cloud Skills Challenges occasionally offer free or discounted vouchers — including past challenges that bundled SC-200 with KQL and Sentinel training.
What is the SC-200 passing score in 2026?
The SC-200 passing score is 700 out of 1000 in 2026. Microsoft uses scaled scoring rather than a flat percentage — questions are weighted by difficulty and case studies count for multiple points. SC-200 case studies often include KQL snippets and Sentinel analytics rule configurations, so KQL reading comprehension matters even on questions that look like multiple choice.
Does the SC-200 certification expire?
Yes — SC-200 is a role-based Associate certification and expires one year after the pass date. Renewal is free through a shorter online assessment on Microsoft Learn. The renewal assessment opens 6 months before expiry and you can retake it for free until you pass. Renewal assessments are typically 25–35 questions and focus on what has changed in Sentinel, Defender XDR, and Defender for Cloud since your last pass.
How is SC-200 different from SC-300?
SC-200 (Security Operations Analyst, $165) is for SOC analysts — your job is detecting and responding to attacks using Microsoft Sentinel, Defender XDR, and Defender for Cloud. SC-300 (Identity and Access Administrator, $165) is for identity administrators — your job is configuring Microsoft Entra ID, Conditional Access, Privileged Identity Management (PIM), and identity governance. SC-200 is operational and KQL-heavy; SC-300 is configuration and policy-focused with no KQL. Both are Associate-level with annual renewal. Take SC-200 if you work in a SOC; take SC-300 if you administer identity.
How is SC-200 different from SC-900?
SC-900 (Security, Compliance, and Identity Fundamentals, $99) is a broad awareness-level exam covering Microsoft Entra, Defender, Purview, and Sentinel concepts. SC-200 (Security Operations Analyst, $165) is a hands-on Associate-level exam focused exclusively on threat detection and response using Sentinel KQL, Defender XDR, and Defender for Cloud. SC-900 tests "what is" questions; SC-200 tests "configure this analytics rule" scenarios. Most SC-200 candidates take SC-900 first to validate foundations, then SC-200 once they have hands-on SOC experience.
How is SC-200 different from SC-100?
SC-200 is an Associate-level Security Operations Analyst certification focused on operational threat detection and response. SC-100 (Cybersecurity Architect Expert, $165) is an Expert-level certification focused on designing enterprise-wide security strategies — Zero Trust architectures, security governance, and aligning Microsoft security products with organizational risk. SC-200 is implementation; SC-100 is design. SC-100 has two prerequisite paths, one of which is SC-200, so they are commonly stacked: SC-200 → SC-100 for security architects who came up through SOC roles.
What is the average SC-200 salary in 2026?
SC-200-certified Security Operations Analysts in the US earn $90,000–$155,000 USD on average in 2026, depending on experience and location. Entry-level SOC analysts (Tier 1) earn $70,000–$95,000, mid-level analysts (Tier 2) with KQL hunting skills earn $100,000–$130,000, and senior SOC engineers or detection engineers reach $130,000–$170,000+. SC-200 pairs especially well with SC-100 (Cybersecurity Architect Expert) to unlock security leadership and architect roles at $150,000–$200,000+.
What are the prerequisites for SC-200?
There are no formal prerequisites, but Microsoft strongly recommends hands-on SOC analyst experience, familiarity with Microsoft Sentinel and Defender XDR, and at least basic KQL skills. SC-900 fundamentals is helpful but not required. Most successful candidates have 6–12 months of hands-on Sentinel work before sitting the exam. Trying SC-200 without any KQL exposure typically requires 12–16 weeks of preparation rather than the typical 8–12.

SC-200 Exam Cost 2026

The SC-200 exam costs $165 USD in 2026. This is the standard Microsoft Associate-level certification price. Pricing varies by country — approximately ₹4,800 INR in India, £113 GBP in the UK, and roughly €165 EUR in most European markets. Confirm the current price on the official Microsoft Learn scheduling page for your region before booking.

There are no formal prerequisites, though Microsoft strongly recommends 6–12 months of hands-on SOC analyst experience and at least basic KQL skills. SC-200 expires annually — renewal is free via a shorter online assessment on Microsoft Learn. Microsoft Ignite, Enterprise Skills Initiative (ESI), and Microsoft Learn Cloud Skills Challenges occasionally offer free vouchers; past challenges have specifically bundled SC-200 with Sentinel and KQL training paths.

SC-200 vs SC-300 vs SC-900: The Security Track

Three Microsoft security certifications, three different roles. Use this comparison to pick the right one for your career path.

SC-900SC-200SC-300
LevelFundamentalsAssociateAssociate
Cost$99$165$165
RoleAwareness for any IT roleSOC analyst, threat hunterIdentity administrator
FocusConcepts (Entra, Defender, Purview, Sentinel)Sentinel KQL, Defender XDR incidents, Defender for CloudEntra ID, Conditional Access, PIM, identity governance
KQL required?NoYes — heavilyNo
Salary (US)$55K–$80K (boosts entry roles)$90K–$155K$85K–$135K
Expires?NoAnnual renewalAnnual renewal

Most candidates take SC-900 first to validate fundamentals, then choose SC-200 for SOC work or SC-300 for identity administration. SC-200 and SC-300 cover different roles — taking both signals you span detection and identity, which is valuable for security engineering roles.

SC-200 vs SC-100: Operations vs Architecture

SC-200 (Associate, $165) is a hands-on Security Operations Analyst certification — your job is detecting and responding to attacks day-to-day using Microsoft Sentinel, Defender XDR, and Defender for Cloud. SC-100 (Cybersecurity Architect Expert, $165) is an Expert-level certification focused on designing enterprise security strategies — Zero Trust architectures, security governance, and aligning Microsoft security products with organizational risk. SC-200 is operational and KQL-heavy; SC-100 is strategic and architecture-focused. SC-200 is one of the prerequisite paths for SC-100, so they are commonly stacked: SC-200 → SC-100 for security architects who came up through SOC roles.

SC-200 Salary and SOC Career Outlook (2026)

SC-200 is one of the highest-leverage Microsoft certifications for SOC and security engineering salaries. Reported US salary ranges in 2026:

  • • SOC Analyst Tier 1 (entry): $70,000–$95,000 USD
  • • SOC Analyst Tier 2 / KQL hunter: $100,000–$130,000 USD
  • • Senior SOC engineer / Detection engineer: $130,000–$170,000 USD
  • • SC-200 + SC-100 (Cybersecurity Architect): $150,000–$200,000+ USD
  • • SC-200 + SC-300 (Security + Identity combo): $120,000–$160,000 USD

Cybersecurity hiring continues to grow well above the IT average, and Microsoft Sentinel/Defender XDR adoption keeps expanding — making SC-200 a direct signal of operational SOC competency. SC-200 is most valuable for analysts moving from Tier 1 to Tier 2/3 roles, where KQL hunting and detection engineering skills materially affect compensation.

SC-200 Exam Topics 2026: Domain Breakdown

Microsoft updated SC-200's domain weights in 2024–2025 to reflect the unified Defender XDR platform. The three current domains:

Manage a Security Operations Environment

40–45%

Configure Microsoft Sentinel (workspaces, data connectors, analytics rules, watchlists, threat intelligence), configure Microsoft Defender XDR settings, configure Defender for Cloud workload protection plans, manage automation (playbooks, automation rules), configure security operations content (workbooks, hunting queries).

Respond to Security Incidents

35–40%

Investigate incidents in Microsoft Defender XDR (Defender for Endpoint, Office 365, Identity, Cloud Apps), respond to alerts and remediate threats, manage Defender for Cloud security alerts and recommendations, investigate Microsoft Sentinel incidents, manage incident response workflows and queue triage.

Perform Threat Hunting

20–25%

Hunt for threats using KQL in Microsoft Sentinel and Defender XDR advanced hunting, develop and tune hunting queries, manage hunting sessions and bookmarks, use Microsoft Threat Intelligence to inform hunts, identify and mitigate threats using behavior analytics.

SC-200 Study Plan: 10-Week Schedule with KQL Phase

Most candidates pass SC-200 with 8–12 weeks of preparation. The KQL phase is the difference between passing and failing — budget time for it explicitly:

  • Week 1–2: KQL fundamentals. Complete Microsoft Learn's KQL learning path. Practice with the Sentinel demo environment or a free Log Analytics workspace. Focus on where, summarize, extend, join, parse, and project operators.
  • Week 3–4: Microsoft Sentinel — workspace setup, data connectors, analytics rules (scheduled, NRT, Fusion, Microsoft security), watchlists, workbooks, automation rules and playbooks.
  • Week 5–6: Defender XDR — Defender for Endpoint configuration and onboarding, Defender for Office 365 policies, Defender for Identity sensors, Defender for Cloud Apps. Practice the incident investigation workflow.
  • Week 7: Defender for Cloud — workload protection plans, security recommendations, regulatory compliance dashboard, alerts. Learn the differences between Defender for Cloud, Defender for Endpoint, and Defender for Servers.
  • Week 8: Threat hunting — KQL hunting queries, advanced hunting in Defender XDR, MITRE ATT&CK alignment. Build at least 5 custom hunting queries.
  • Week 9–10: Two full timed mock exams. Review every wrong answer. Target consistent 80%+ before booking. Case study time management matters — budget 12–15 minutes per case study.

Training your whole team on SC-200? Per-seat pricing covers every certification, with a manager dashboard to see who's exam-ready.

See team pricing →

Also Preparing For

Candidates studying SC-200 often prepare for these certifications next.

SC-900

Security, Compliance, and Identity Fundamentals

Practice test →SC-300

Microsoft Identity and Access Administrator

Practice test →MS-102

Microsoft 365 Administrator

Practice test →