SC-200: Microsoft Security Operations Analyst Exam Prep

Learn how Microsoft 365 Defender correlates alerts into incidents, triages and investigates threats, and hunts for anomalies, using incident queues, filters, and remediation to close cases.

Investigate incidents by understanding incident properties, managing alerts, and automating responses within Microsoft Defender, including incident scope, evidence, severity, and automated playbooks.

Learn Azure AD identity protection, including conditional access and MFA, and how Defender for Identity analyzes on premise AD signals to detect risks and generate alerts. Discover how Defender for Identity integrates with Defender for cloud apps, Microsoft 365 Defender, and Sentinel.

Explore Microsoft Defender for cloud apps, its casb role, and data protection via labeling, policies, conditional access, and anomaly detection.

Implement data loss prevention with purview by defining sensitive information types, applying sensitivity labels, and configuring prevention policies; review and resolve dlp alerts in purview and defender for cloud apps.

Define insider risk and describe how to manage it with Microsoft Purview insider risk management, using real-time signals, policy templates, and triaged alerts to mitigate data access and policy violations.

Learn how to mitigate threats using Microsoft Defender for Endpoint on laptops and mobile devices. Onboard devices, create device groups, apply automated remediation, and manage access with RBAC.

Configure attack surface reduction in Microsoft Defender for Endpoint to harden devices with built-in rules (block, audit, warn) covering executables and scripts, via Intune, Group Policy, or PowerShell.

Explore the device page in Microsoft Defender for Endpoint to review alerts and security recommendations. Learn device investigation workflows, including collecting data, live responses, blocking, and basic to advanced commands.

Explore how to investigate files, user accounts, and domains in Microsoft Defender for Endpoint using forensic artifacts and deep analysis to assess suspicious activity in an incident.

Configure alerts and automations in Defender for Endpoint to tailor email notifications, alert suppression, and automation levels, while leveraging vulnerability management and threat intelligence to remediate risks.

Discover Microsoft Defender for cloud, a cloud workload protection platform offering CSPM, agentless continuous assessment, and remediation across servers, storage, database, containers, and multi-cloud environments.

Provision and connect resources to Microsoft Defender for cloud using asset inventory, auto and manual provisioning, and Azure Arc to secure Azure and non-Azure workloads, including AWS.

Explore how cloud security score and compliance drive Microsoft Defender for Cloud, through policy definitions and initiatives, recommendations, and cross‑cloud assessments reported with Azure Workbook.

Protect Azure workloads with Microsoft Defender for Cloud across servers, storage, databases, App Service, and Key Vault, and configure features to monitor, alert, and remediate.

Learn how defender for cloud classifies and responds to alerts by severity, applies remediation steps, automates responses with Logic Apps, and uses threat intelligence reports to connect related incidents.

Explore Microsoft Sentinel, a cloud-native SIEM that collects logs, detects threats with built-in intelligence, and automates response across hybrid and Azure environments, using data connectors, analytics rules, and SOAR.

Configure Microsoft Sentinel workspace within Azure Log Analytics workspace, considering scope and region. Implement RBAC roles to manage access and data ingestion, including Reader, Responder, Contributor, and Automation Contributor.

Explore how logs and tables in Microsoft Sentinel form a structured database, enable KQL queries for threat hunting and analytics, support workbook views, and integrate data from Microsoft 365 Defender.

Define and manage watch lists in Microsoft Sentinel to correlate external data with events, enable threat hunting and playbooks, and edit or bulk update using get watch list with deduplication.

Explore how threat intelligence in Microsoft Sentinel collects indicators, such as IPs and file hashes, and uses data connectors, analytic rules, and threat intelligence indicator table to query with KQL.

Connect data sources to Microsoft Sentinel with built-in, custom, and vendor data connectors such as AWS and Google Cloud; configure prerequisites and licenses to enable log analysis and incidents.

Connect Microsoft 365 Defender to Microsoft Sentinel using built-in connectors, configure prerequisites, and consolidate alerts into incidents while understanding legacy versus modern connectors.

Connect Windows host machines to Azure Sentinel using AMA or legacy connectors, configure data collection rules, and monitor Sysmon and DNS events for security insights.

Connect event and syslog data to Microsoft Sentinel by configuring CF connectors and syslog forwarders, then parse the syslog table with KQL to extract security indicators.

Connect threat intelligence indicators to Microsoft Sentinel using TAXII/TIP connectors and the Graph Security API, and view them in the Threat Intelligence Indicator table via KQL queries.

Explore Microsoft Sentinel analytics, detect anomalies across data sources, and create, modify, and automate analytic rules from templates or the wizard.

Automate incident response in Microsoft Sentinel with automation rules and playbooks, configuring triggers and actions to auto respond to alerts and incidents via Analytics Rule Wizard and Logic Apps.

Learn how data normalization in Microsoft Sentinel unifies diverse sources with the Asim parser, enabling cross-source detection, custom parsers, and unified queries via Kql.

Visualize and manage data in Microsoft Sentinel by building workbooks from templates, integrating multiple data sources, and querying with KQL, then manage content via templates and external repositories.

Explore the Microsoft Sentinel interface and Content Hub, load Azure activity content such as workbooks, analytic rules, data connectors, and hunting queries, and learn to add repositories like GitHub.

Learn the basics of kql, the kusto query language, and how to write tabular queries with let and set statements. Explore operators like where, search, and case, with Sentinel examples.

Practice KQL on the Microsoft site with predefined tables like VM computers and VM process; learn to select fields, filter by display name, count results, and sort by Azure location.