SaveMyCert
Log in
5 of 5 free questions left today·for 10 a day
SC-200 revision

SC-200 study guide — free revision notes

The complete Microsoft Certified: Security Operations Analyst Associate study library — 13 lessons mapped to every domain and topic in the official exam guide. Free to read, no account needed.

Lessons
13
across 3 domains
Reading time
4 hrs
241 minutes in total
Exam
50 Qs
100 min · pass 700 / 1000
Price
Free
no account required
Ingest Windows security events into Microsoft Sentinel
SC-200 Windows Security Events in Microsoft Sentinel: AMA, DCRs and WEF16 min
Ingest Syslog, CEF, Azure activity, threat indicators and custom logs
SC-200 Sentinel Data Ingestion: Syslog, CEF, Azure Activity, Threat Intelligence and Custom Logs15 min

Create a free account to track completed lessons, bookmark topics and see your exam readiness. · Pro lessons unlock with a one-time upgrade.

The SC-200 blueprint, domain by domain

Microsoft Azure publishes exactly what the SC-200 tests and how much each part is worth. Here it is — every domain, its weight, the topics inside it, and the lessons that cover them.

Domain 1

Manage a security operations environment

42%
of the exam

Configuring the SOC platform: Defender XDR notifications, automated investigation and attack disruption, Defender for Endpoint settings, policies and device groups, Sentinel automation rules and playbooks, Sentinel roles, retention tiers, workbooks and SOC optimization, data connectors and ingestion, and detections in both Defender XDR and Sentinel. Official weighting 40–45%.

7 topics in this domain
  • Configure automation in Microsoft Defender XDR
  • Configure Microsoft Defender for Endpoint
  • Configure automation in Microsoft Sentinel
  • Configure the Microsoft Sentinel SIEM and platform
  • Ingest Windows security events into Microsoft Sentinel
  • Ingest Syslog, CEF, Azure activity, threat indicators and custom logs
  • Configure detections
7 lessons · 120 min of reading · 217 practice questionsStart this domain
Domain 2

Respond to security incidents

37%
of the exam

Investigating and remediating alerts and incidents across Defender for Office 365, Purview, Defender for Cloud, Defender for Cloud Apps, Entra ID, Defender for Identity and Sentinel; agentic AI with Security Copilot; multi-stage attacks and case management; Defender for Endpoint device response; and Microsoft 365 investigation with Purview Audit, Content search and Graph activity logs. Official weighting 35–40%.

4 topics in this domain
  • Investigate and remediate alerts from Microsoft Defender workloads, Purview and Entra ID
  • Investigate Sentinel incidents, complex attacks and cases, including with Security Copilot
  • Respond to alerts and incidents in Microsoft Defender for Endpoint
  • Investigate Microsoft 365 activities to identify threats
4 lessons · 80 min of reading · 192 practice questionsStart this domain
Domain 3

Perform threat hunting

21%
of the exam

Hunting with KQL: choosing tables and writing Advanced Hunting queries, interpreting threat analytics, hunting graphs and blast radius, Sentinel Graph entity relationships, Sentinel hunting queries, KQL jobs and summary rules in the data lake, and notebooks connected to the Sentinel MCP Server. Official weighting 20–25%.

2 topics in this domain
  • Detect threats by using Microsoft Defender XDR
  • Detect threats by using the Microsoft Sentinel platform
2 lessons · 41 min of reading · 110 practice questionsStart this domain

How to revise for the SC-200

Reading every note front to back is the slowest way to pass. The exam is weighted, so your revision should be too — the blueprint above tells you exactly where the marks are.

Read in weight order, not page order

Manage a security operations environment carries the most marks on the SC-200, so it earns the most of your attention. Work down the blueprint from the heaviest domain to the lightest rather than starting at domain 1 and grinding forward.

First pass for coverage, second pass for recall

Read each lesson once without stopping to memorise — you are building a map, not a memory. On the second pass, read only the "what's tested" and key-takeaway blocks. If a takeaway surprises you, that lesson goes back on the pile.

Turn takeaways into questions

Cover a lesson's key takeaways and try to say them out loud from the heading alone. Recall you can produce under your own steam is the only recall that survives a timed exam; recognition on a re-read is not the same thing.

Stop reading when practice, not the page count, says so

Finishing the notes is not the goal — scoring is. Move to SC-200 practice questions early, then come back to the exact lessons your wrong answers point at. That loop is worth far more than a third read-through.

Beyond the SC-200 notes

SC-200 cheat sheetEvery key takeaway from these notes on one page, grouped by domain. For the week of the exam.SC-200 flashcardsThe same key facts one at a time, answer hidden until you commit — recall practice rather than re-reading.SC-200 practice questions519 exam-realistic questions with an explanation on every option. Reading is not the same as knowing.SC-200 mock exams50 questions in 100 minutes, scored like the real thing. Sit one before you book.Microsoft Certified: Security Operations Analyst Associate (SC-200) exam overviewExam facts, who it is for, cost and how it fits alongside the other certifications.

SC-200 revision notes: your questions

Yes. All 13 SC-200 lessons are readable in full without an account and without payment. Creating a free account adds progress tracking, bookmarks and a readiness score — it does not unlock extra reading.

Source

Exam structure, domain weights and scoring on this page come from the official SC-200 exam guide.