Examworthyexamworthy.comMicrosoft Security Operations Analyst (SC-200) cheat sheet
Microsoft
Free to share. Examworthy is not affiliated with or endorsed by Microsoft; SC-200 and related marks belong to their respective owners.
At a glance
Format: Multiple choice and multiple response, at a Pearson VUE testing center or online proctored
Domain weight map
Heaviest first - spend your time hereHow this exam thinks
SC-200 is a run-the-SOC exam: nearly every question hands you a constrained Microsoft Sentinel or Microsoft Defender XDR scenario and asks for the single capability that meets it with the least admin effort, the correct signal source, and the right scope, and the traps are real features that fit all but one constraint.
Spot the trap
Tempting wrong answers, and why they failCommon misconception
That Warn mode measures an ASR rule's impact silently the way Audit mode does. Warn shows the user a dismissible prompt on every trigger, disrupting their workflow and letting them bypass the rule.
Manage a Security Operations Environment
Common misconception
That IdentityLogonEvents shows endpoint sign-ins for lateral-movement tracing. It records directory-layer authentications from domain controllers, not device-level logons.
Respond to Security Incidents
Common misconception
That SigninLogs captures on-premises domain controller authentication because it already logs sign-ins. SigninLogs is an Entra ID cloud sign-in table; IdentityLogonEvents holds the on-premises Kerberos and NTLM logon detail.
Perform Threat Hunting
Common misconception
That a device matching several device groups joins all of them and inherits the most restrictive merged settings. A device belongs to exactly one group, the first match by rank, and Defender never merges group policies.
Manage a Security Operations Environment
Common misconception
That an inner join just filters to matching rows without changes. It duplicates a row per match and adds right-side columns; leftsemi filters cleanly instead.
Respond to Security Incidents
Common misconception
That the search operator is an efficient way to find a known value in a large table. It performs an unindexed scan across every column, reading far more data than a targeted equality predicate.
Perform Threat Hunting
Common misconception
That adding a file as an allow custom indicator suppresses the alert it triggers. Allow indicators stop blocking and remediation for the file rather than hiding the alert, and can open a path to genuinely malicious use of it.
Manage a Security Operations Environment
Common misconception
That an Inactive health state means a device was never onboarded. It means an onboarded device stopped reporting; unonboarded ones show as Can be onboarded.
Respond to Security Incidents
Key terms
Exam-day rules
- Name the owning capability first. Decide whether the stem is about a Sentinel analytics rule, a Defender XDR custom detection, an automation rule, a playbook, a device response action, or a hunting artefact before you read the options, so you narrow the field before comparing details.
- Separate real-time from scheduled and automatic from manual. If the stem demands sub-minute latency on one source it is a near-real-time rule; if it demands autonomous containment of an active attack it is automatic attack disruption; if it demands recurring aggregation across tables it is a scheduled analytics rule.
- Pick the right telemetry table in KQL. Process lineage with parent and child command lines is DeviceProcessEvents, not DeviceEvents; outbound connections are DeviceNetworkEvents; reach for make-series, not summarize with bin, when you need an even gap-filled time series for beaconing.
- Choose the least-privilege, lowest-effort option. When more than one configuration would technically work, the exam wants the narrowest scope and the fewest manual steps, such as Microsoft Sentinel Contributor over a subscription role, or an Azure Policy deployIfNotExists over per-resource diagnostic settings.
- Match the verdict to the workload. In Microsoft Entra ID Protection use Confirm user compromised to record a true positive; in Microsoft Purview use eDiscovery (Premium) for holds and defensible export; on a device use the live response run command to execute a pre-approved library script.
Revision schedule
- Day 1Read the refreshed blueprint and book a date
- Week 1Build the detection and automation backbone
- Week 1 to 2Master data connectors and ingestion
- Week 2 to 3Work through cross-workload incident response
- Week 3Drill KQL and threat hunting