100+ Free SC-200 Practice Questions
Pass your Microsoft Certified: Security Operations Analyst Associate (SC-200) exam on the first try — instant access, no signup required.
You ingest a custom application log to Sentinel and want it to land in a new table. Which item must you create or configure?
Explore More Microsoft Certifications
Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.
More From This Family
Videos and articles for deeper review.
Key Facts: SC-200 Exam
40-60
Exam Questions
Microsoft Learn
700/1000
Passing Score
Microsoft scaled
100 min
Exam Duration
Microsoft Learn
$165
Exam Fee (USD)
Microsoft pricing
Apr 2026
Skills Updated
Microsoft Learn
1 year
Renewal Cycle
Free on Microsoft Learn
SC-200 is Microsoft's associate-level Security Operations Analyst certification. The April 16, 2026 update has three domains: Manage a security operations environment (40-45%), Respond to security incidents (35-40%), and Perform threat hunting (20-25%). Coverage includes Microsoft Defender XDR, Microsoft Sentinel (now with Data lake tier and Sentinel Graph), Defender for Cloud workload protections, Defender for Identity, Defender for Cloud Apps, Defender for Office 365, Entra ID, Purview, KQL hunting, automation/playbooks, and embedded Copilot for Security. $165 USD via Pearson VUE; 100 minutes; 700/1000 to pass.
Sample SC-200 Practice Questions
Try these sample questions to test your SC-200 exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.
1Which Microsoft Defender for Endpoint advanced feature stops attackers from changing antivirus settings through apps, scripts, or registry edits?
2Which advanced feature must be enabled before an analyst can open a remote investigation shell on a managed device from the unified Defender portal?
3Enabling the Microsoft Intune connection in Microsoft Defender for Endpoint primarily allows you to do what?
4An analyst wants to receive an email whenever a new high-severity incident is created in the Microsoft Defender portal. Where is this configured?
5Which Microsoft Defender for Endpoint capability automatically isolates a compromised device, suspends user accounts, or blocks a malicious URL across the tenant when high-confidence signals are detected?
6Which automation level in Defender for Endpoint will remediate malicious files automatically without requiring analyst approval?
7You want to block Office apps from creating child processes only on the finance device group, while keeping the rest of the org in audit mode. What is the best approach?
8Which Microsoft Sentinel object should you use to run a Logic Apps workflow as a response to an alert or incident?
9An automation rule should close incidents matching a known false-positive pattern. Which two configuration elements are required?
10Which Microsoft Sentinel role can create and edit analytics rules and playbooks but cannot manage workspace permissions?
About the SC-200 Exam
SC-200 validates the skills required to operate as a Microsoft security operations analyst — triaging alerts, responding to incidents, hunting for threats, and engineering detections across Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra ID, Microsoft Purview, and Microsoft Defender for Cloud workload protections. The April 16, 2026 update adds Sentinel Graph, the Sentinel Data lake retention tier, agentic AI investigation with embedded Copilot for Security, KQL jobs, and the Sentinel MCP Server.
Questions
50 scored questions
Time Limit
100 minutes
Passing Score
700/1000 (scaled, ~70%)
Exam Fee
$165 USD (Microsoft / Pearson VUE)
SC-200 Exam Content Outline
Manage a security operations environment
Configure automation for Microsoft Defender XDR and Sentinel (notifications, ASR rules, AIR, attack disruption, automation rules, playbooks); configure the Sentinel SIEM and platform (roles, retention across Analytics/Data lake/XDR tiers, workbooks, SOC optimization); ingest data via Windows Security Events via AMA, WEF, Syslog/CEF via AMA, Azure activities, threat indicators, and custom log tables; configure detections via Advanced Hunting custom detection rules, Sentinel analytics rules (scheduled, NRT, threat intelligence, ML), MITRE ATT&CK coverage, and anomalies.
Respond to security incidents
Investigate and remediate alerts and incidents in Microsoft Defender XDR across Defender for Office 365, Purview, Defender for Cloud workload protections, Defender for Cloud Apps, Entra ID, Defender for Identity, and Sentinel; investigate complex multi-stage, multi-domain, and lateral-movement attacks; investigate by using agentic AI with embedded Copilot for Security; manage incidents with case management; respond in Defender for Endpoint via device timelines, live response, evidence collection, and automatic attack disruption; investigate Microsoft 365 activities via Audit, Content Search, and Microsoft Graph activity logs.
Perform threat hunting
Detect threats with Microsoft Defender XDR by selecting the right Advanced Hunting table, writing KQL, interpreting threat analytics, building hunting graphs and blast radius views, and analyzing entity relationships in Sentinel Graph; detect threats in Microsoft Sentinel by creating and monitoring hunting queries, managing KQL jobs in the Data lake tier, building Summary rule tables, and hunting in Notebooks connected to the Sentinel MCP Server.
How to Pass the SC-200 Exam
What You Need to Know
- Passing score: 700/1000 (scaled, ~70%)
- Exam length: 50 questions
- Time limit: 100 minutes
- Exam fee: $165 USD
Keys to Passing
- Complete 500+ practice questions
- Score 80%+ consistently before scheduling
- Focus on highest-weighted sections
- Use our AI tutor for tough concepts
SC-200 Study Tips from Top Performers
Frequently Asked Questions
What is the SC-200 exam?
SC-200 is Microsoft's associate-level certification for security operations analysts. It validates skills to triage, investigate, and respond to threats across Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra ID, Microsoft Purview, and Microsoft Defender for Cloud workload protections, and to hunt threats with KQL and Sentinel Graph. The current skills measured are dated April 16, 2026.
How many questions are on SC-200?
SC-200 typically delivers 40-60 questions in 100 minutes. Question formats include multiple choice, multiple select, drag-and-drop, active-screen interactive scenarios, and short case studies. The passing score is 700 out of 1000 on a scaled scoring system.
What does SC-200 cost in 2026?
The SC-200 exam fee is $165 USD in the United States (regional pricing varies). Microsoft Learn training is free. The certification is valid for one year and renews free of charge through the renewal assessment on Microsoft Learn.
How is SC-200 different from AZ-500 and SC-100?
SC-200 focuses on operating the Microsoft security stack as a SOC analyst — detection, investigation, response, and hunting. AZ-500 focuses on engineering Azure platform security controls. SC-100 is the expert architect exam built on top of both. Most analysts take SC-200 first; SC-100 has SC-200 (or AZ-500) as a recommended prerequisite.
How should I prepare for SC-200 in 2026?
Build hands-on time in Microsoft Defender XDR (security.microsoft.com) and Microsoft Sentinel — connect data via AMA, write Advanced Hunting KQL, configure scheduled and NRT analytics rules, and trigger automation rules and playbooks. Practice incident investigation across Defender for Office 365, Defender for Cloud Apps, Defender for Identity, and Entra ID. Try the embedded Copilot for Security agentic experiences. Then do timed practice — at least 100 questions — focused on the April 16, 2026 skills outline.
Is SAT, GRE, or any academic exam needed before SC-200?
No. SC-200 is a professional certification with no academic prerequisites. Microsoft recommends prior hands-on experience with the security stack (Defender XDR, Sentinel, Entra, Purview) and basic KQL skill, but there is no required degree, course, or other certification.