SC-200 is Microsoft Security Operations Analyst. It is an associate-level, hands-on exam that earns the Microsoft Certified: Security Operations Analyst Associate certification. It is the SOC analyst exam: you are tested on running Microsoft Sentinel and Defender XDR, responding to incidents, and hunting threats with KQL.

What are the SC-200 domain weights?

Only three domains. Manage a security operations environment is the largest at 40 to 45 percent. Respond to security incidents is 35 to 40 percent. Perform threat hunting is 20 to 25 percent. Configuration and response together are roughly 75 to 85 percent of the exam.

Is SC-200 changing on July 28, 2026?

A new objectives version takes effect on July 28, 2026, but the change log is undramatic. Every functional group is marked No change, and the affected sub-skills plus the audience profile are marked Minor. No domain was renamed and no weight moved. The exam is being refreshed, not rewritten.

How much does the SC-200 exam cost?

SC-200 does not appear as its own entry in Microsoft's published exam pricing feed, so we will not quote a per-code figure. Associate role-based exams are normally $165 USD in the United States. Confirm the price at checkout, because it varies by the country or region in which the exam is proctored.

Do you need to know KQL for SC-200?

Yes. Kusto Query Language is named three times in the threat-hunting domain, which is 20 to 25 percent of the exam. The bullets require you to identify the appropriate table for a query, identify threats using KQL, and create Advanced Hunting queries. You cannot pass the hunting domain by recognizing KQL; you have to read it.

How hard is SC-200 compared to SC-900?

It is a different kind of exam. SC-900 asks you to describe products and mentions Sentinel twice. SC-200 asks you to configure and operate them and mentions Sentinel sixteen times and Defender twenty times. SC-900 is a vocabulary exam; SC-200 is a job exam.

How many questions are on the SC-200 exam and how long is it?

Microsoft publishes no question count for SC-200 and does not print a duration on its exam page. Its general guidance is that most exams contain 40 to 60 questions. Its exam-type table gives associate exams 100 minutes, or 120 minutes if the exam may contain labs, and Microsoft deliberately does not publish which exams have labs.

What score do you need to pass SC-200?

700 or greater on a scale of 1 to 1000. Microsoft notes that because this is a scaled score, it may not equal 70 percent of the points. Microsoft publishes no pass rate for SC-200 or any other exam, so any pass-rate percentage you see quoted was invented.

SC-200 practice test

SC-200 Practice Test, Practice Questions and Exam Prep From Your Own SOC Notes

Upload your Sentinel runbooks, Defender XDR notes or prep PDF, and the AI writes unlimited SC-200 practice questions with an answer key in seconds. Weighted to the three domains Microsoft actually publishes.

Your study files are processed securely and deleted automatically after your practice questions are built.

Upload your SC-200 notes or prep PDF and generate your first question set

Click to upload or drag and drop

PDF, DOCX, PPTX, TXT, JPG, JPEG, PNG, HEIC, ODP, ODT, BMP, or TIFF

up to 20MB

Please wait, your quiz is being created...

Uploading...

SC-200 is Microsoft's Security Operations Analyst exam, and it is the most product-saturated exam Microsoft sells. Three domains only: managing the SOC environment is 40 to 45 percent, responding to incidents is 35 to 40 percent, and threat hunting is 20 to 25 percent. In roughly 630 words of skills text, "Defender" appears 20 times and "Sentinel" 16 times. You need 700 out of 1000. A refreshed objectives version takes effect on July 28, 2026, and Microsoft's change log marks every functional group as "No change." The outline now includes agentic AI, embedded Security Copilot, and hunting through the Sentinel MCP Server.

Last updated July 2026

SC-200 is the first Microsoft exam that asks you to hunt through an MCP server

Buried at the end of the threat-hunting domain is a bullet most prep material has not caught up with: "Hunt for threats by using Notebooks, including connection to the Sentinel MCP Server." Model Context Protocol, the standard that lets an AI assistant call live tools, is now examinable content on a Microsoft security certification.

It is not the only one. The incident-response domain includes "Investigate incidents by using agentic AI, including embedded Microsoft Security Copilot." Across the seven Microsoft exams we counted this month, SC-200 is the only one whose skills outline names Security Copilot at all. Not SC-900, not SC-300, not AZ-140. Just this one.

That matters for how you study. A question bank assembled a year ago cannot contain a single question about Sentinel Graph, the Sentinel data lake, blast-radius hunting graphs, KQL jobs in the data lake, or case management, and all five are in the current outline. This is the exact situation where generating practice questions from your own current Sentinel notes beats buying a static bank, because the product surface is moving faster than the banks are.

Term in the official skills outline	SC-200	SC-900	SC-300
Defender	20	11	3
Sentinel	16	2	0
KQL	3	0	0
Security Copilot	1	0	0
MCP	1	0	0
Purview	3	6	0

Counts taken from the skills sections of each exam's official Microsoft study guide, current July 2026.

Passing score: 700 / 1000
Domains: 3
New objectives: Jul 28, 2026
Practice questions: Unlimited

SC-200 skills measured, straight from Microsoft's study guide

Three domains, current as of the version effective July 28, 2026. Most Microsoft associate exams have four or five. This one has three, and it is dense.

Domain	What is actually in it	Weight
Manage a security operations environment	Configuring alert and email notifications, tuning and suppression, Defender for Endpoint advanced features and attack surface reduction rules, automated investigation and response, automatic attack disruption, device groups and automation levels. Then Sentinel: automation rules, playbooks, roles, workbooks, SOC optimization, and data retention across Analytics, Data lake and XDR tiers. Then ingestion: data connectors, Windows Security Events via AMA, Windows Event Forwarding, Syslog and CEF via AMA, Azure Policy and diagnostic settings, threat indicators, custom log tables. Then detection: custom detection rules in Advanced Hunting, analytics rules including scheduled, NRT, threat intelligence and machine learning, MITRE ATT&CK coverage analysis, anomalies. The biggest domain by a wide margin.	40 to 45%
Respond to security incidents	Investigate and remediate across the whole estate: Defender for Office 365, Purview, Defender for Cloud workload protections, Defender for Cloud Apps, compromised identities in Entra ID, Defender for Identity, Sentinel. Then agentic AI investigation with embedded Security Copilot, multi-stage and lateral-movement attacks, case management, device timelines, live response and investigation packages, evidence and entity investigation, Purview Audit, Content search in eDiscovery, Microsoft Graph activity logs.	35 to 40%
Perform threat hunting	Identify the right table for a query. Identify threats using KQL. Create Advanced Hunting queries. Interpret threat analytics. Create hunting graphs including blast radius. Analyze entity relationships with Sentinel Graph. Create and monitor hunting queries. KQL jobs in the Data lake. Summary rule tables. Hunt with Notebooks, including connection to the Sentinel MCP Server. The smallest domain and the one people fail.	20 to 25%

The trap in this exam is the weighting versus the difficulty. Threat hunting is the smallest domain at 20 to 25 percent, but it is the only one that requires you to read code under time pressure. People allocate study time by percentage, spend 80 percent of it on configuration bullets they can memorize, then meet a KQL query they cannot parse. Invert that. Configuration rewards flashcards. Hunting does not.

SC-200 does not appear as its own entry in Microsoft's exam pricing feed, so we do not quote a per-code fee. Associate role-based exams are normally $165 in the United States; confirm at checkout. Microsoft publishes no question count for SC-200 and does not print a duration on its exam page. Its exam-type table allots associate exams 100 minutes, or 120 minutes if the exam may contain labs.

How to build SC-200 practice questions that match a moving target

Sentinel and Defender ship changes constantly. A question bank ages faster here than on any other Microsoft exam.

1 Upload your own runbooks: Your SOC's Sentinel notes, the current SC-200 study guide, or Defender XDR docs you actually work from.
2 Front-load the hunting domain: It is only 20 to 25 percent, but KQL is the part you cannot bluff. Start there, not last.
3 Cover the new surface: Sentinel Graph, the data lake tiers, case management, agentic investigation. Old banks have none of it.
4 Separate the Defenders: Twenty mentions across seven products. Most lost points come from picking the wrong Defender.

SC-200 questions, answered

What is Exam SC-200?: SC-200 is Microsoft Security Operations Analyst. It is an associate-level, hands-on exam that earns the Microsoft Certified: Security Operations Analyst Associate certification. It is the SOC analyst exam: you are tested on running Microsoft Sentinel and Defender XDR, responding to incidents, and hunting threats with KQL.
What are the SC-200 domain weights?: Only three domains. Manage a security operations environment is the largest at 40 to 45 percent. Respond to security incidents is 35 to 40 percent. Perform threat hunting is 20 to 25 percent. Configuration and response together are roughly 75 to 85 percent of the exam.
Is SC-200 changing on July 28, 2026?: A new objectives version takes effect on July 28, 2026, but the change log is undramatic. Every functional group is marked "No change," and the affected sub-skills plus the audience profile are marked "Minor." No domain was renamed and no weight moved. The exam is being refreshed, not rewritten.
How much does the SC-200 exam cost?: SC-200 does not appear as its own entry in Microsoft's published exam pricing feed, so we will not quote a per-code figure. Associate role-based exams are normally $165 USD in the United States. Confirm the price at checkout, because it varies by the country or region in which the exam is proctored.
Do you need to know KQL for SC-200?: Yes. Kusto Query Language is named three times in the threat-hunting domain, which is 20 to 25 percent of the exam. The bullets require you to identify the appropriate table for a query, identify threats using KQL, and create Advanced Hunting queries. You cannot pass the hunting domain by recognizing KQL; you have to read it.
How hard is SC-200 compared to SC-900?: It is a different kind of exam. SC-900 asks you to describe products and mentions Sentinel twice. SC-200 asks you to configure and operate them, and mentions Sentinel sixteen times and Defender twenty times. SC-900 is a vocabulary exam; SC-200 is a job exam.
How many questions are on the SC-200 exam and how long is it?: Microsoft publishes no question count for SC-200 and does not print a duration on its exam page. Its general guidance is that most exams contain 40 to 60 questions. Its exam-type table gives associate exams 100 minutes, or 120 minutes if the exam may contain labs, and Microsoft deliberately does not publish which exams have labs.
What score do you need to pass SC-200?: 700 or greater on a scale of 1 to 1000. Microsoft notes that because this is a scaled score, it may not equal 70 percent of the points. Microsoft publishes no pass rate for SC-200 or any other exam, so any pass-rate percentage you see quoted was invented.

PDFQuiz is not affiliated with, endorsed by, or sponsored by Microsoft. Microsoft, Azure, Entra, Defender, Sentinel, Purview and Security Copilot are trademarks of the Microsoft group of companies. This generator builds practice questions from material you upload and is a study aid, not a substitute for Microsoft's official learning paths. Always confirm exam details on Microsoft's own pages before you book.

Related study tools

The prerequisite most people take first is SC-900, the $99 fundamentals exam. On the engineering track rather than the analyst track, SC-500 is replacing AZ-500, which retires August 31, 2026. For a vendor-neutral SOC credential, the closest equivalents are the CySA+ practice test and the Security+ practice test generators. Senior security managers usually head for CISSP. For any source document at all, use the certification exam generator.

Build your first SC-200 practice set

The Sentinel surface moves faster than the question banks do. Upload your current notes and generate exam-style questions in under a minute.

Start Creating Practice Questions

Z tej samej rodziny narzędzi