SC-200 2026: Microsoft SOC Workflow Study Guide
Video
Which Microsoft Defender for Endpoint advanced feature stops attackers from changing antivirus settings through apps, scripts, or registry edits?
Manage Security Operations Environment
Question · Easy
A current SC-200 guide for security operations analysts: the 2026 Microsoft skills outline, July 28 2026 update, price, languages, Sentinel, Defender XDR, incident response, KQL, and threat hunting.
Blog
Microsoft Defender XDR
Defender XDR Platform
Flashcard
Which advanced feature must be enabled before an analyst can open a remote investigation shell on a managed device from the unified Defender portal?
Class of platform that gathers logs, correlates alerts, and lets analysts investigate activity across an estate.
Operations platform
Guess the Term
Introduction & SC-200 Exam Overview
1.1 SC-200 Exam Facts
Study guide
Cheat sheet
Enabling the Microsoft Intune connection in Microsoft Defender for Endpoint primarily allows you to do what?
Question · Medium
Read the clue and guess the term in 6 tries.
Game
Incident vs. alert in Defender XDR
An analyst wants to receive an email whenever a new high-severity incident is created in the Microsoft Defender portal. Where is this configured?
Sentinel capability area that runs playbooks to handle alerts with little manual effort.
Playbooks
Which Microsoft Defender for Endpoint capability automatically isolates a compromised device, suspends user accounts, or blocks a malicious URL across the tenant when high-confidence signals are detected?
Automatic attack disruption
Which automation level in Defender for Endpoint will remediate malicious files automatically without requiring analyst approval?
Extension-based collector that follows data collection rules to pull machine logs into Microsoft Sentinel.
Log ingestion
1.2 Role & Recommended Knowledge
You want to block Office apps from creating child processes only on the finance device group, while keeping the rest of the org in audit mode. What is the best approach?
Swap tiles to line up three of the same term.
Term Match
Microsoft Secure Score vs. threat analytics
Which Microsoft Sentinel object should you use to run a Logic Apps workflow as a response to an alert or incident?
Built-in subscription mechanism that sends chosen operational or administrative log entries from devices to a central collector server.
An automation rule should close incidents matching a known false-positive pattern. Which two configuration elements are required?
Defender for Endpoint: device isolation vs. live response
Defender for Endpoint
Which Microsoft Sentinel role can create and edit analytics rules and playbooks but cannot manage workspace permissions?
Configuration object that centralizes which sources are gathered, how records are changed, and where they are sent.
1.3 Skills Measured & Study Strategy
You need to retain Microsoft Sentinel logs for seven years for regulatory purposes but only need fast SOC queries on the most recent 90 days. Which configuration aligns to the 2026 Sentinel platform?
Flip two cards at a time to find matching terms.
Term Pairs
Attack Surface Reduction (ASR) rules
Which feature surfaces ranked recommendations to improve Sentinel cost efficiency and detection coverage based on your tenant's telemetry?
Defender for Endpoint policy set that blocks behaviors such as Office apps creating child processes.
Endpoint hardening
Which connector should you choose to ingest Windows Security events from domain controllers into Microsoft Sentinel using the recommended 2026 pattern?
Tamper protection
Your network appliance can emit syslog in CEF format. What is the recommended Sentinel ingestion path?
Defender XDR feature that examines alerts and can apply remediation on its own or after approval.
Remediation
Manage a Security Operations Environment: Defender XDR & Sentinel Setup
2.1 Configure Microsoft Defender XDR
Which approach forwards Windows Security events from many endpoints through a single collector before AMA ships them to Sentinel?
Find five hidden terms in a grid of letters.
Term Search
Automated investigation and remediation (AIR)
You want all Azure subscription activity (control-plane operations) to flow into Sentinel without per-subscription manual configuration. What is the best approach?
Analytics rule type that runs every minute to catch threats quickly.
Detections
Where in Microsoft Sentinel do you ingest STIX/TAXII threat indicators so they can match incoming events?
Defender for Office 365: Safe Attachments vs. Safe Links
Defender Workloads & Identity
Loading more…
