Free Practice Questions for SC-200
Exam-style questions and explanations by OpenExamPrep.
Loading practice questions...
Explore More Microsoft Certifications
Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.
Course PlaylistMore From This Family
Videos and articles for deeper review.
Key Facts: SC-200 Exam
40-60
Exam Questions
Microsoft Learn
700/1000
Passing Score
Microsoft scaled
100 min
Exam Duration
Microsoft Learn
$165
Exam Fee (USD)
Microsoft pricing
Apr 2026
Skills Updated
Microsoft Learn
1 year
Renewal Cycle
Free on Microsoft Learn
SC-200 is Microsoft's associate-level Security Operations Analyst certification. The skills measured as of October 21, 2026 have three domains: Manage a security operations environment (40-45%), Respond to security incidents (35-40%), and Perform threat hunting (20-25%). Coverage includes Microsoft Defender XDR, Microsoft Sentinel (now with Data lake tier and Sentinel Graph), Defender for Cloud workload protections, Defender for Identity, Defender for Cloud Apps, Defender for Office 365, Entra ID, Purview, KQL hunting, automation/playbooks, and embedded Microsoft Security Copilot. $165 USD via Pearson VUE; 100 minutes; 700/1000 to pass.
Sample SC-200 Practice Questions
Try these sample questions to review concepts for the SC-200 exam. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.
1Which Microsoft Defender for Endpoint advanced feature stops attackers from changing antivirus settings through apps, scripts, or registry edits?
2Which advanced feature must be enabled before an analyst can open a remote investigation shell on a managed device from the unified Defender portal?
3Enabling the Microsoft Intune connection in Microsoft Defender for Endpoint primarily allows you to do what?
4An analyst wants to receive an email whenever a new high-severity incident is created in the Microsoft Defender portal. Where is this configured?
5Which Microsoft Defender for Endpoint capability automatically isolates a compromised device, suspends user accounts, or blocks a malicious URL across the tenant when high-confidence signals are detected?
6Which automation level in Defender for Endpoint will remediate malicious files automatically without requiring analyst approval?
7You want to block Office apps from creating child processes only on the finance device group, while keeping the rest of the org in audit mode. What is the best approach?
8Which Microsoft Sentinel object should you use to run a Logic Apps workflow as a response to an alert or incident?
9An automation rule should close incidents matching a known false-positive pattern. Which two configuration elements are required?
10Which Microsoft Sentinel role can create and edit analytics rules and playbooks but cannot manage workspace permissions?
About the SC-200 Exam
SC-200 validates the skills required to operate as a Microsoft security operations analyst — triaging alerts, responding to incidents, hunting for threats, and engineering detections across Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra ID, Microsoft Purview, and Microsoft Defender for Cloud workload protections. The skills measured as of October 21, 2026 include Sentinel Graph, the Sentinel Data lake retention tier, agentic AI investigation with embedded Microsoft Security Copilot, KQL jobs, and the Sentinel MCP Server.
Exam sponsor: Microsoft / Pearson VUE. The requirements and fees below concern the certification or admission exam, separate from our free practice resources.
Assessment
Question count not published by the exam provider
Time Limit
100 minutes
Passing Score
700/1000 (scaled, ~70%)
Reported exam pass rate: ~65-75%. industry estimate; Microsoft does not publish official SC-200 pass rates This describes exam candidates, not OpenExamPrep users or results from using our resources. Exam sponsor website
Fees, eligibility, and exam policies can change. Confirm them with the exam sponsor before applying or paying.
Official sources
- SC-200 exam page (Microsoft Learn)
- SC-200 study guide (skills measured as of October 21, 2026)
- Microsoft Defender XDR documentation
- Microsoft Sentinel documentation
- Microsoft Defender for Cloud documentation
- Microsoft Security Copilot documentation
- Free SC-200 Practice Assessment (Microsoft)
- Exam Registration (Pearson VUE)
Our practice resources: topics covered
We aim to reflect publicly available exam outlines and topic information in our study resources. Coverage, format, and difficulty may differ from the actual exam, and we cannot guarantee that every detail is accurate or current. Confirm exam requirements, fees, and policies with the official exam sponsor.
Manage a security operations environment
Configure automation for Microsoft Defender XDR and Sentinel (notifications, ASR rules, AIR, attack disruption, automation rules, playbooks); configure the Sentinel SIEM and platform (roles, retention across Analytics/Data lake/XDR tiers, workbooks, SOC optimization); ingest data via Windows Security Events via AMA, WEF, Syslog/CEF via AMA, Azure activities, threat indicators, and custom log tables; configure detections via Advanced Hunting custom detection rules, Sentinel analytics rules (scheduled, NRT, threat intelligence, ML), MITRE ATT&CK coverage, and anomalies.
Respond to security incidents
Investigate and remediate alerts and incidents in Microsoft Defender XDR across Defender for Office 365, Purview, Defender for Cloud workload protections, Defender for Cloud Apps, Entra ID, Defender for Identity, and Sentinel; investigate complex multi-stage, multi-domain, and lateral-movement attacks; investigate by using agentic AI with embedded Microsoft Security Copilot; manage incidents with case management; respond in Defender for Endpoint via device timelines, live response, evidence collection, and automatic attack disruption; investigate Microsoft 365 activities via Audit, Content Search, and Microsoft Graph activity logs.
Perform threat hunting
Detect threats with Microsoft Defender XDR by selecting the right Advanced Hunting table, writing KQL, interpreting threat analytics, building hunting graphs and blast radius views, and analyzing entity relationships in Sentinel Graph; detect threats in Microsoft Sentinel by creating and monitoring hunting queries, managing KQL jobs in the Data lake tier, building Summary rule tables, and hunting in Notebooks connected to the Sentinel MCP Server.
Preparing for the SC-200 Exam
What You Need to Know
- Passing score: 700/1000 (scaled, ~70%)
- Assessment: Question count not published by the exam provider
- Time limit: 100 minutes
- Exam / certification fees: $165 USD Official sources
Using Our Practice Resources
- Work through all 100 available questions
- Review every answer and explanation
- Track weak areas and revisit them
- Use our AI tutor for tough concepts
SC-200: Suggested Study Strategy
Frequently Asked Questions
What is the SC-200 exam?
SC-200 is Microsoft's associate-level certification for security operations analysts. It validates skills to triage, investigate, and respond to threats across Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra ID, Microsoft Purview, and Microsoft Defender for Cloud workload protections, and to hunt threats with KQL and Sentinel Graph. The current skills measured are dated October 21, 2026.
How many questions are on SC-200?
SC-200 typically delivers 40-60 questions in 100 minutes. Question formats include multiple choice, multiple select, drag-and-drop, active-screen interactive scenarios, and short case studies. The passing score is 700 out of 1000 on a scaled scoring system.
What does SC-200 cost in 2026?
The SC-200 exam fee is $165 USD in the United States (regional pricing varies). Microsoft Learn training is free. The certification is valid for one year and renews free of charge through the renewal assessment on Microsoft Learn.
How is SC-200 different from SC-500 and SC-100?
SC-200 focuses on operating the Microsoft security stack as a SOC analyst — detection, investigation, response, and hunting. SC-500 (which replaced AZ-500 on August 31, 2026) focuses on engineering cloud and AI security controls. SC-100 is the expert architect exam built on top of both. Most analysts take SC-200 first; SC-100 requires SC-200, SC-300, or SC-500 as its prerequisite associate certification.
How should I prepare for SC-200 in 2026?
Build hands-on time in Microsoft Defender XDR (security.microsoft.com) and Microsoft Sentinel — connect data via AMA, write Advanced Hunting KQL, configure scheduled and NRT analytics rules, and trigger automation rules and playbooks. Practice incident investigation across Defender for Office 365, Defender for Cloud Apps, Defender for Identity, and Entra ID. Try the embedded Microsoft Security Copilot agentic experiences. Then do timed practice — at least 100 questions — focused on the October 21, 2026 skills outline.
Is SAT, GRE, or any academic exam needed before SC-200?
No. SC-200 is a professional certification with no academic prerequisites. Microsoft recommends prior hands-on experience with the security stack (Defender XDR, Sentinel, Entra, Purview) and basic KQL skill, but there is no required degree, course, or other certification.