How many SC-200 practice questions are there?

297 questions across 1 version, each with the correct answer and an explanation.

Are there free SC-200 sample questions?

Yes. 40 sample questions are free; 20 are open to everyone and the rest unlock with a free account.

What does full access include?

Every SC-200 question in study, timed and flashcard modes, explanations for each answer, and progress that saves so you can resume.

What topics does SC-200 cover?

Manage a security operations environment (22%), Configure protections and detections (17%), Manage incident response (27%), Manage security threats (17%).

How much does the SC-200 exam cost?

The SC-200 exam fee is $165 (USD; local pricing varies by region and provider).

What is the passing score for SC-200?

You need 700 on a 100-1000 scale to pass SC-200.

How long is the SC-200 certification valid?

1 year. Recertification: Annual renewal assessment.

SC-200Security Operations Analyst practice test

297 Microsoft SC-200 practice questions with explanations, in study, timed and flashcard modes. 40 samples are free.

Full access

$69.99

All 297 questions with explanations · Study, timed and flashcard modes · Progress saved, resume any time

Try the free samples first

Questions: 297
Free samples: 40
Versions: 1
Updated: Jan 2026

Practice SC-200 in the simulator.

Study, timed and flashcard modes. Answers and explanations as you go, and your progress saves.

Open the simulator Try the free samples

SC-200, by the numbers.

Official specifications published by Microsoft.

Duration: 120 min
Questions: 40-60
Passing score: 700 on a 100-1000 scale
Exam fee: $165
In the bank: v1 (297)

Open the full exam guide

Everything about SC-200.

SC-200 · Microsoft · v2.0

Exam information

Official specifications published by Microsoft, plus what is in our question bank.

Duration: 120 min
Questions: 40-60
Passing score: 700 on a 100-1000 scale
Level: Associate
Question types: multiple_choice, multiple_response, drag_drop, case_study

What SC-200 covers

4 weighted domains. Open a domain for its topics, and a topic for its objectives. Practice questions are tagged to these.

Three ways to practise

Study mode

Work through the bank at your own pace with the answer and explanation one tap away. Flag questions, add notes, bookmark the hard ones.

Open in the simulator

Timed mode

A shuffled deck with a countdown that mirrors the real exam. Your score is saved to your attempt history.

Open in the simulator

Flashcards

Question on the front, answer on the back. Good for the last week before the exam.

Open in the simulator

SC-200Security Operations Analyst practice test

Full access

Practice SC-200 in the simulator.

SC-200, by the numbers.

Everything about SC-200.

Exam information

What SC-200 covers

How to study for this exam?

What's changed on this exam?

Who should take this exam?

Three ways to practise

Study mode

Timed mode

Flashcards

SC-200 questions, answered

SC-200Security Operations Analyst practice test

Full access

Practice SC-200 in the simulator.

SC-200, by the numbers.

Everything about SC-200.

Exam information

01Exam format120 min · 40-605

02Registration$165 · Pearson VUE, online proctoring3

03Validity1 year2

04In our question bankv1 (297)

What SC-200 covers

01Manage a security operations environment22%73 topics

1.1Configure protections and detections (15–20%)Configure and manage configure protections and detections (15–20%)1 obj.

1.2Manage incident response (25–30%)Configure and manage manage incident response (25–30%)1 obj.

1.3Manage security threats (15–20%)Configure and manage manage security threats (15–20%)1 obj.

1.4Configure alert and vulnerability notification rulesConfigure and manage configure alert and vulnerability notification rules1 obj.

1.5Configure Microsoft Defender for Endpoint advanced featuresConfigure and manage configure microsoft defender for endpoint advanced features1 obj.

1.6Configure endpoint rules settingsConfigure and manage configure endpoint rules settings1 obj.

1.7Manage automated investigation and response capabilities in MicrosoftConfigure and manage manage automated investigation and response capabilities in microsoft1 obj.

1.8Configure automatic attack disruption in Microsoft Defender XDRConfigure and manage configure automatic attack disruption in microsoft defender xdr1 obj.

1.9Configure and manage device groups, permissions, and automation levelsConfigure and manage configure and manage device groups, permissions, and automation levels1 obj.

1.10Identify unmanaged devices in Microsoft Defender for EndpointConfigure and manage identify unmanaged devices in microsoft defender for endpoint1 obj.

1.11Discover unprotected resources by using Defender for CloudConfigure and manage discover unprotected resources by using defender for cloud1 obj.

1.12Identify and remediate devices at risk by using Microsoft DefenderConfigure and manage identify and remediate devices at risk by using microsoft defender1 obj.

1.13Mitigate risk by using Exposure Management in Microsoft Defender XDRConfigure and manage mitigate risk by using exposure management in microsoft defender xdr1 obj.

1.14Plan a Microsoft Sentinel workspaceConfigure and manage plan a microsoft sentinel workspace1 obj.

1.15Configure Microsoft Sentinel rolesConfigure and manage configure microsoft sentinel roles1 obj.

1.16Specify Azure RBAC roles for Microsoft Sentinel configurationConfigure and manage specify azure rbac roles for microsoft sentinel configuration1 obj.

1.17Design and configure Microsoft Sentinel data storage, including logConfigure and manage design and configure microsoft sentinel data storage, including log1 obj.

1.18Identify data sources to be ingested for Microsoft SentinelConfigure and manage identify data sources to be ingested for microsoft sentinel1 obj.

1.19Implement and use Content hub solutionsConfigure and manage implement and use content hub solutions1 obj.

1.20Configure and use Microsoft connectors for Azure resources, includingConfigure and manage configure and use microsoft connectors for azure resources, including1 obj.

1.21Plan and configure Syslog and Common Event Format (CEF) eventConfigure and manage plan and configure syslog and common event format (cef) event1 obj.

1.22Plan and configure collection of Windows Security events by using dataConfigure and manage plan and configure collection of windows security events by using data1 obj.

1.23Create custom log tables in the workspace to store ingested dataConfigure and manage create custom log tables in the workspace to store ingested data1 obj.

1.24Monitor and optimize data ingestionConfigure and manage monitor and optimize data ingestion1 obj.

1.25Configure policies for Microsoft Defender for Cloud AppsConfigure and manage configure policies for microsoft defender for cloud apps1 obj.

1.26Configure policies for Microsoft Defender for Office 365Configure and manage configure policies for microsoft defender for office 3651 obj.

1.27Configure security policies for Microsoft Defender for Endpoints,Configure and manage configure security policies for microsoft defender for endpoints,1 obj.

1.28Configure cloud workload protections in Microsoft Defender for CloudConfigure and manage configure cloud workload protections in microsoft defender for cloud1 obj.

1.29Configure and manage custom detection rulesConfigure and manage configure and manage custom detection rules1 obj.

1.30Manage alerts, including tuning, suppression, and correlationConfigure and manage manage alerts, including tuning, suppression, and correlation1 obj.

1.31Configure deception rules in Microsoft Defender XDRConfigure and manage configure deception rules in microsoft defender xdr1 obj.

1.32Classify and analyze data by using entitiesConfigure and manage classify and analyze data by using entities1 obj.

1.33Configure and manage analytics rulesConfigure and manage configure and manage analytics rules1 obj.

1.34Query Microsoft Sentinel data by using ASIM parsersConfigure and manage query microsoft sentinel data by using asim parsers1 obj.

1.35Implement behavioral analyticsConfigure and manage implement behavioral analytics1 obj.

1.36Investigate and remediate threats by using Microsoft Defender forConfigure and manage investigate and remediate threats by using microsoft defender for1 obj.

1.37Investigate and remediate ransomware and business email compromiseConfigure and manage investigate and remediate ransomware and business email compromise1 obj.

1.38Investigate and remediate compromised entities identified by MicrosoftConfigure and manage investigate and remediate compromised entities identified by microsoft1 obj.

1.39Investigate and remediate threats identified by Microsoft PurviewConfigure and manage investigate and remediate threats identified by microsoft purview1 obj.

1.40Investigate and remediate alerts and incidents identified by MicrosoftConfigure and manage investigate and remediate alerts and incidents identified by microsoft1 obj.

1.41Investigate and remediate security risks identified by MicrosoftConfigure and manage investigate and remediate security risks identified by microsoft1 obj.

1.42Investigate and remediate compromised identities that are identifiedConfigure and manage investigate and remediate compromised identities that are identified1 obj.

1.43Investigate and remediate security alerts from Microsoft Defender forConfigure and manage investigate and remediate security alerts from microsoft defender for1 obj.

1.44Investigate device timelinesConfigure and manage investigate device timelines1 obj.

1.45Perform actions on the device, including live response and collectingConfigure and manage perform actions on the device, including live response and collecting1 obj.

1.46Perform evidence and entity investigationConfigure and manage perform evidence and entity investigation1 obj.

1.47Investigate threats by using the unified audit logConfigure and manage investigate threats by using the unified audit log1 obj.

1.48Investigate threats by using Content SearchConfigure and manage investigate threats by using content search1 obj.

1.49Investigate threats by using Microsoft Graph activity logsConfigure and manage investigate threats by using microsoft graph activity logs1 obj.

1.50Investigate and remediate incidents in Microsoft SentinelConfigure and manage investigate and remediate incidents in microsoft sentinel1 obj.

1.51Create and configure automation rulesConfigure and manage create and configure automation rules1 obj.

1.52Create and configure Microsoft Sentinel playbooksConfigure and manage create and configure microsoft sentinel playbooks1 obj.

1.53Run playbooks on on-premises resourcesConfigure and manage run playbooks on on-premises resources1 obj.

1.54Create and use promptbooksConfigure and manage create and use promptbooks1 obj.

1.55Manage sources for Security Copilot, including plugins and filesConfigure and manage manage sources for security copilot, including plugins and files1 obj.

1.56Integrate Security Copilot by implementing connectorsConfigure and manage integrate security copilot by implementing connectors1 obj.

1.57Manage permissions and roles in Security CopilotConfigure and manage manage permissions and roles in security copilot1 obj.

1.58Monitor Security Copilot capacity and costConfigure and manage monitor security copilot capacity and cost1 obj.

1.59Identify threats and risks by using Security CopilotConfigure and manage identify threats and risks by using security copilot1 obj.

1.60Investigate incidents by using Security CopilotConfigure and manage investigate incidents by using security copilot1 obj.

1.61Identify threats by using Kusto Query Language (KQL)Configure and manage identify threats by using kusto query language (kql)1 obj.

1.62Interpret threat analytics in the Microsoft Defender portalConfigure and manage interpret threat analytics in the microsoft defender portal1 obj.

1.63Create custom hunting queries by using KQLConfigure and manage create custom hunting queries by using kql1 obj.

1.64Analyze attack vector coverage by using the MITRE ATT&CK matrixConfigure and manage analyze attack vector coverage by using the mitre att&ck matrix1 obj.

1.65Manage and use threat indicatorsConfigure and manage manage and use threat indicators1 obj.

1.66Create and manage huntsConfigure and manage create and manage hunts1 obj.

1.67Create and monitor hunting queriesConfigure and manage create and monitor hunting queries1 obj.

1.68Use hunting bookmarks for data investigationsConfigure and manage use hunting bookmarks for data investigations1 obj.