Microsoft

Microsoft Security Operations Analyst (SC-200)
exam objectives

Validates hands-on skill managing a security operations environment, responding to incidents, and hunting for threats using Microsoft Defender XDR, Microsoft Sentinel, Entra ID, and Purview.

Questions
60
Duration
100 min
Passing score
700
Domains
3

340 practice questions available for SC-200 on CertPilot AI, mapped to the domains below.

SC-200 exam domains and weightings

The SC-200 exam is split into 3 domains. The percentage next to each is the share of the exam it accounts for — study time is best spent proportionally.

1.0Manage a security operations environment

42%

141 practice questions in this domain

  • 1.1Configure automation for Microsoft Defender XDR and Microsoft Sentinel
  • 1.2Configure the Microsoft Sentinel SIEM and platform
  • 1.3Ingest data into the Microsoft Sentinel SIEM and platform
  • 1.4Configure detections

2.0Respond to security incidents

37%

124 practice questions in this domain

  • 2.1Respond to alerts and incidents in Microsoft Defender XDR
  • 2.2Respond to alerts and incidents in Microsoft Defender for Endpoint
  • 2.3Investigate Microsoft 365 activities to identify threats

3.0Perform threat hunting

21%

75 practice questions in this domain

  • 3.1Detect threats by using Microsoft Defender XDR
  • 3.2Detect threats by using the Microsoft Sentinel platform

How to prepare for Microsoft Security Operations Analyst

Most candidates fail SC-200 not because they didn't know the material, but because they couldn't tell which material they were weakest on. Reading the objectives end to end treats every domain as equally important — the exam doesn't. On SC-200, Manage a security operations environment alone is 42% of your score.

CertPilot AI works the other way around. It tracks your accuracy per domain, weights each domain by its real exam share, and pulls most of each practice session from wherever you're currently weakest. The result is a single readiness score — at 90% you're in the range where candidates typically pass, so you book the exam on evidence instead of a hunch.

Every question comes with an AI explanation of why the right answer is right and why each distractor is wrong. The Exam Decoder goes further and breaks down how to read a question — the qualifiers, the scenario framing, and the trap options — which is the skill that separates a 740 from a 700.

Microsoft Security Operations Analyst (SC-200) FAQ

How many questions are on the Microsoft Security Operations Analyst (SC-200) exam?

The SC-200 exam has up to 60 questions and you get 100 minutes to complete it.

What score do you need to pass Microsoft Security Operations Analyst?

Microsoft Security Operations Analyst requires a scaled score of 700. Scaled scoring means the raw number of correct answers is adjusted for the difficulty of the specific question set you were served, so there is no fixed percentage that guarantees a pass.

What domains does the SC-200 exam cover?

Microsoft Security Operations Analyst is divided into 3 domains: Manage a security operations environment (42%), Respond to security incidents (37%), Perform threat hunting (21%). The heaviest weighted domain is Manage a security operations environment at 42% of the exam.

How do I know when I'm ready to book the SC-200 exam?

CertPilot AI calculates a readiness score by weighting your accuracy in each domain by that domain's share of the real exam, then scaling it by how many questions you've actually answered — so a domain you've barely touched can't inflate the number. At 90% you're in the range where candidates typically pass.

How much does the SC-200 exam cost?

The Microsoft Security Operations Analyst exam voucher typically costs around $165 USD. Pricing varies by region and vendors periodically adjust it, so confirm on the official vendor site before booking.

Free to start

Start practising SC-200 questions

Adaptive sessions weighted to the domains above, AI explanations on every question, and a readiness score that tells you when to book.

Start free

Other Microsoft certifications