Pass the SC-200 exam.
Become the SOC analyst every team wants. Master Microsoft Sentinel, Defender XDR and KQL threat hunting - the exact skills the exam measures.
The 2 measured SC-200 domains.
Mitigate threats using Microsoft Defender XDR
Mitigate threats using Microsoft Sentinel
Key skills you will master
- KQL queries for hunting and detection
- Incident triage and management in the unified portal
- Device, email and identity investigations
- Threat hunting and Livestream sessions
- Analytics rules, ASIM normalization and UEBA
- SOAR automation with playbooks and logic apps
Everything you need inside PassYour.
90+ lessons
Every SC-200 domain, from your first KQL query to full SOAR playbooks.
650+ questions
Exam-style questions with detailed rationales for every option.
450+ flashcards
Spaced repetition for KQL operators, tables and Defender/Sentinel concepts.
5 mock exams
Timed, 40-60 questions, with domain-level score analytics.
SC-200 FAQ.
What is the SC-200 certification?
SC-200 (Microsoft Security Operations Analyst Associate) validates your ability to detect, investigate and respond to threats using Microsoft Sentinel and Microsoft Defender XDR. It is THE certification for SOC analysts working in the Microsoft ecosystem.
How many questions are on the SC-200 exam?
The SC-200 exam contains 40-60 questions (multiple choice, case studies, drag-and-drop) with a 100-minute time limit. The passing score is 700/1000. Registration costs $165 USD depending on your country.
What does the exam cover exactly?
Two measured domains: mitigating threats with Microsoft Defender XDR (40-45%) and with Microsoft Sentinel (55-60%). In practice, expect heavy KQL, incident management, threat hunting and SOAR automation questions.
Do I need experience before taking SC-200?
Microsoft recommends familiarity with Azure, Microsoft 365 and basic security concepts (SC-900 level). Hands-on SOC experience helps, but our 90+ lessons walk you through every tool from zero - including a full KQL track.
Does the SC-200 certification expire?
Yes - Microsoft role-based certifications renew every 12 months, for free, via a short online assessment. Our lessons stay updated so re-certification is painless.
Ready to become a certified SOC analyst?
One payment, lifetime access to the full SC-200 track: lessons, question bank, flashcards and mock exams.
PassYour is an independent study aid and is not affiliated with or endorsed by Microsoft. SC-200 and Microsoft Sentinel are trademarks of Microsoft Corporation.