Microsoft Security Operations Analyst

The SC-200 certification validates skills in threat detection, investigation, and response using Microsoft security technologies. It covers Microsoft Sentinel (SIEM), Microsoft Defender XDR (extended detection and response), Microsoft Defender for Endpoint, Microsoft Defender for Cloud, threat hunting with KQL, incident management, and security automation using playbooks and workbooks.

This certification is designed for security operations analysts who work in Security Operations Centers (SOCs) monitoring, identifying, investigating, and responding to threats. Candidates should have experience with Microsoft Sentinel, Defender products, KQL for threat hunting, and implementing automated response workflows to security incidents across hybrid environments.

The exam consists of 40–60 questions to be completed in approximately 100 minutes (120 minutes if labs are included). Question types include multiple-choice, multiple-select, drag-and-drop, hot area, and case study formats. Questions are scenario-based, presenting security incidents and asking you to investigate and respond using Sentinel and Defender tools. Expect KQL queries for threat hunting and questions about detection rule creation.

This exam requires hands-on security operations experience. Candidates who understand security concepts but haven't used Microsoft Sentinel for investigation and KQL for threat hunting often struggle with the practical scenarios.

Delivered via Pearson VUE online or at testing centers. Available in English, Japanese, Chinese, Korean, French, German, Spanish, and more. The certification is valid for 1 year with a free renewal assessment on Microsoft Learn.