Microsoft Security Operations Analyst Associate
The SC-200 exam is designed for professionals who implement and configure Security. It validates your ability to manage a security operations environment, respond to security incidents, and perform threat hunting.
Exam details
- Certification
- Microsoft Security Operations Analyst Associate
- Exam code
- SC-200
- Level
- Associate
- Duration
- Approximately 100 minutes
- Questions
- Typically 40–60 questions
- Passing score
- 700 out of 1000
- Cost
- USD $165 — typical price; the exact fee varies by country/region and currency, and local taxes may apply.
- Prerequisites
- None required
- Languages
- English (also available in Japanese, Korean, French and German, and several other languages)
- Delivered by
- Pearson VUE
- Renewal
- Free online assessment, every 12 months
Skills measured
Manage a security operations environment (40–45%)
- Configure Defender XDR automation, notifications, device groups, and attack disruption.
- Configure Sentinel roles, data retention, workbooks, connectors, and analytics rules.
- Create custom detections, hunting rules, anomalies, and MITRE ATT&CK coverage analysis.
Respond to security incidents (35–40%)
- Investigate and remediate alerts across Defender XDR, Purview, Defender for Cloud, and Entra ID.
- Respond on devices with live response, investigation packages, and automatic attack disruption.
- Investigate Microsoft 365 activity with Purview Audit, eDiscovery, and Graph activity logs.
Perform threat hunting (20–25%)
- Hunt with KQL, Advanced Hunting, threat analytics, and Sentinel Graph.
- Create hunting queries, KQL jobs, summary tables, and notebooks, including Sentinel MCP.
Study resources & practice tests
Disclosure: some links below are affiliate links. If you buy through them we may earn a commission, at no extra cost to you. Read our affiliate disclosure.
Frequently asked questions
Who should take SC-200?
SC-200 is for security operations analysts, SOC analysts, and detection engineers. Most work in corporate SOCs, at managed security providers, or in financial services, healthcare, and public-sector security teams.
What is the average salary for a Security Operations Analyst?
As of 2026, US SOC analysts commonly earn about $75,000 to $100,000 at L2, with L1 closer to $55,000 to $85,000. In the United Kingdom, Barclay Simpson 2026 places security operations analysts around £40,000 to £55,000 UK-wide (£45,000 to £60,000 in central London). In western Europe, SOC analyst pay is often about €35,000 to €62,000. There is no single published EMEA average.
Where do I find exam questions to practice?
You will find websites selling exam dumps or brain dumps that claim to be real SC-200 questions. Those materials are not official. Microsoft treats using brain dumps as cheating. It can invalidate your score, revoke certifications you already hold, and ban you from future exams. Microsoft publishes a free Practice Assessment for SC-200 on Microsoft Learn. Those questions are examples only, not the live exam. MeasureUp also sells the official practice test linked in the study resources on this page. You can try the Microsoft exam sandbox to see the question types and timer, but it does not use real exam questions. Practise the skills measured in a real product environment rather than memorising leaked items.
Does the exam include official labs I can use to practice?
Microsoft does not publish a stable list of which certification exams include labs, and a lab can be dropped for a candidate if the live environment is unavailable. Role-based Azure and security exams such as SC-200 may include performance-based labs in a live cloud environment. You only find out at the start of your sitting. For practice, Microsoft Learn modules for this exam often include a free Azure sandbox, and official instructor-led SC-200T00 training delivered by a Microsoft Learning Partner includes labs. Those labs are for the course, not a copy of the exam. Applied Skills assessment labs are a separate Microsoft credential, not SC-200 exam labs. The Microsoft exam sandbox shows traditional question types only. It does not give you the lab virtual machine.