SC-200 Security Operations Analyst Study Guide with KQL Practice

SC-200 is the exam for the Microsoft Certified: Security Operations Analyst Associate certification, and the fastest way to pass it is to study by the three weighted domains in Microsoft's current skills outline: configure the security operations environment (40-45%), respond to security incidents (35-40%) and hunt for threats (20-25%). Build a small Microsoft Defender XDR and Microsoft Sentinel lab, practise each named objective there, and drill Kusto Query Language (KQL) until choosing a table and shaping a query is routine. This guide uses the skills measured as of October 21, 2026.

Who this is for and what you will have at the end

This guide is for people moving into a security operations centre (SOC) role, for IT administrators who have been handed Defender or Sentinel, and for analysts renewing or re-aligning with the updated outline. By the end you will have a domain-by-domain checklist, a four-week schedule, a list of labs that map to the objectives, and a set of KQL practice queries against tables that Microsoft documents.

Microsoft describes the candidate as someone who performs triage, responds to incidents, hunts for threats and engineers detections across multi-cloud and on-premises environments, using Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra ID, Microsoft Purview and Microsoft Defender for Cloud workload protections.

Exam facts to confirm first

The facts below come from the official SC-200 study guide and certification page, both checked on October 25, 2026. Re-check them before you book, because Microsoft changes exams periodically.

The study guide includes a change log noting that the October 21, 2026 update made a minor change to the "Ingest data into the Microsoft Sentinel SIEM and platform" objective. The outline now refers to Sentinel data lake tiers, KQL jobs in the data lake, summary rule tables, Sentinel Graph, notebooks and the Sentinel MCP Server, and it also covers agentic investigation with embedded Microsoft Security Copilot. Older blog posts and video courses may predate these topics.

Skills measured, domain by domain

Manage a security operations environment (40-45%)

This is the largest domain and the one candidates most often under-prepare, because it is configuration work rather than detective work. It has four objectives.

• Configure automation for Defender XDR and Sentinel. Email and alert notifications in Defender XDR, Microsoft Defender for Endpoint advanced features, rules settings and custom data collection, security policies including attack surface reduction (ASR) rules, automated investigation and response, automatic attack disruption, device groups with permissions and automation levels, and Sentinel automation rules and playbooks.
• Configure the Sentinel SIEM and platform. Sentinel roles, data retention for XDR and Sentinel tables across the Analytics, Data lake and XDR tiers, workbooks, and SOC optimization recommendations.
• Ingest data. Choosing data connectors, collecting Windows Security events with Windows Security Events via AMA and data collection rules, planning Windows Event Forwarding (WEF), Syslog and Common Event Format (CEF) via AMA, Azure activity logs through Azure Policy and diagnostic settings, threat indicators, and custom log tables.
• Configure detections. Custom detection rules from advanced hunting in Defender XDR, Sentinel analytics rules (scheduled, near-real time, threat intelligence and machine learning), MITRE ATT&CK coverage analysis and anomalies.

Respond to security incidents (35-40%)

The second domain covers working incidents end to end.

• Defender XDR alerts and incidents. Investigate and remediate threats from Defender for Office 365, Microsoft Purview, Defender for Cloud workload protections, Defender for Cloud Apps, Microsoft Entra ID compromised identities, Defender for Identity and Sentinel. It also lists investigating incidents with agentic AI including embedded Security Copilot, investigating multi-stage and lateral-movement attacks, and case management.
• Defender for Endpoint. Device timelines, device actions such as live response and collecting investigation packages, evidence and entity investigation, and incidents from automatic attack disruption.
• Microsoft 365 activities. Microsoft Purview Audit, Content search in Purview eDiscovery and Microsoft Graph activity logs.

Perform threat hunting (20-25%)

The smallest domain is also the one that rewards daily practice.

• Defender XDR. Picking the right KQL table, identifying threats with KQL, writing advanced hunting queries, interpreting threat analytics, building hunting graphs including blast radius, and analyzing entity relationships with Sentinel Graph.
• Sentinel platform. Creating and monitoring hunting queries, KQL jobs in the data lake, summary rule tables, and notebooks including connection to the Sentinel MCP Server.

A four-week study plan

Adjust the pace to your experience. The order follows the exam weights, with hunting practice running alongside every week.

Start each week by reading the matching objective lines in the study guide and ending it by ticking them off. If you cannot describe where to click, or what a setting changes, you are not yet ready on that line.

Labs that map to the objectives

You need a tenant where you are allowed to make changes. Use a developer or trial tenant, never a production tenant, and keep the Sentinel workspace small so costs stay low. Check current licensing and pricing pages for the trial you use, because this guide does not state prices.

1. Notifications and tuning. In Defender XDR, configure an email notification for incidents and one for threat analytics, then open alert tuning and review how suppression and correlation are presented.
2. Defender for Endpoint policy. Onboard a test device, create a device group, set an automation level, and review attack surface reduction rules in security policy. Read the device timeline after a harmless action such as opening a script.
3. Sentinel ingestion. Add a Windows Security Events via AMA connector and a data collection rule on a test virtual machine, and confirm events arrive. Then add Azure activity logs through diagnostic settings.
4. Analytics rule and automation. Create a scheduled analytics rule, map it to MITRE ATT&CK, and add an automation rule that changes severity or assigns an owner. Build a simple playbook and attach it.
5. Incident response. Work through the generated incidents, using entity pages, the device timeline and live response where available. Practise writing short closing notes the way a case-management process expects.
6. Purview investigation. Run an audit search and a Content search in eDiscovery, and open Microsoft Graph activity logs so you know where the data comes from.
7. Data lake and summary rules. If your tenant has the Sentinel data lake, create a KQL job and a summary rule table, and open a notebook. The skills outline lists them, so recognise what each is for.

KQL practice for SC-200

KQL runs through all three domains, so practise a little every day. The queries below use tables Microsoft documents. DeviceLogonEvents is an advanced hunting table populated by Defender for Endpoint, and it returns no results if the service is not deployed. SigninLogs is the Microsoft Entra sign-in table in Azure Monitor Logs, where a ResultType of 0 indicates success and other values are failures.

Count device logons by type over the last day in advanced hunting:

DeviceLogonEvents
| where Timestamp > ago(1d)
| summarize Logons = count() by LogonType
| sort by Logons desc

Find failed Entra sign-ins and group them by user and source address in Sentinel:

SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType != "0"
| summarize Failures = count() by UserPrincipalName, IPAddress, ResultDescription
| sort by Failures desc

Break failures into hourly bins, which is how you spot a spray that trickles over time. The bin() function reduces a datetime to discrete values, and Microsoft's documentation notes you should use explicit binning:

SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType != "0"
| summarize Failures = count() by bin(TimeGenerated, 1h)
| sort by TimeGenerated asc

After each query, practise three habits the exam rewards: choosing the right table before writing anything, filtering on time first, and using project and summarize to return only what an analyst needs. Then turn one of the queries into a custom detection rule in Defender XDR or a scheduled analytics rule in Sentinel, since "Configure detections" is part of the largest domain.

Troubleshooting your preparation

• An advanced hunting table returns nothing. Tables such as DeviceLogonEvents are populated by Defender for Endpoint, so an empty result usually means no devices are onboarded.
• Your notes disagree with the exam objectives. Compare the date on your material with the October 21, 2026 outline and add the new data lake, Security Copilot and agentic topics.
• You can read incidents but not configure anything. Return to the first domain. It is 40-45 percent of the exam, and every line begins with a verb such as configure, manage, create or specify.
• A free tenant lacks a feature. Read the feature's documentation for its licence requirements, and learn the concept and where the setting lives even if you cannot enable it.

Final checklist before you book

• Every objective line in the study guide has a lab or a note.
• You can write the three KQL queries above from memory and explain each operator.
• You have completed the free practice assessment and reviewed each wrong answer.
• You have tried the exam sandbox to see the question types.
• You have confirmed price, language and booking details on the exam page for your country.

For related reading on this site, see Defender for Endpoint onboarding with Intune and attack surface reduction rules rollout, which cover products the exam assumes you know.

References

• Study guide for Exam SC-200: https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/sc-200
• Microsoft Certified: Security Operations Analyst Associate: https://learn.microsoft.com/en-us/credentials/certifications/security-operations-analyst/
• DeviceLogonEvents table in the advanced hunting schema: https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-devicelogonevents-table
• SigninLogs table reference: https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs
• summarize operator (Kusto): https://learn.microsoft.com/en-us/kusto/query/summarize-operator