SC-200 study plan

Your step-by-step plan

1. Read the refreshed blueprint and book a date

   Day 1

   Read the three domains from the 16 April 2026 refresh and note that Manage a Security Operations Environment is the largest, Respond to Security Incidents is close behind, and Perform Threat Hunting is the smallest. Book a provisional date now to turn open-ended study into a plan, and make sure you have a Microsoft Sentinel workspace and a Microsoft Defender XDR tenant you can configure, because this exam rewards hands-on practice over reading.

2. Build the detection and automation backbone

   Week 1

   In the Microsoft Sentinel and Microsoft Defender portals, set an attack surface reduction rule to Audit and watch DeviceEvents, build a scheduled analytics rule and a near-real-time rule side by side, and save an Advanced Hunting query as a Microsoft Defender XDR custom detection. Wire an automation rule to call a playbook on incident creation, assign a Microsoft Sentinel Contributor role at workspace scope, and configure an Azure Policy deployIfNotExists assignment for diagnostic logs.

3. Master data connectors and ingestion

   Week 1 to 2

   Configure connectors for Windows security events, Syslog, and CEF, and trace how each lands in the workspace tables. Enable the Azure Activity connector, ingest threat indicators, and add a custom log source, then contrast a per-resource diagnostic setting against the policy-driven approach so you can answer least-effort-at-scale questions. Map a handful of analytics rules to MITRE ATT&CK and read SOC optimization recommendations and retention tiers.

4. Work through cross-workload incident response

   Week 2 to 3

   Open a correlated Microsoft Defender XDR incident and study the incident graph and attack story. Drill into a device page and separate the Incidents and alerts tab from the Timeline tab. Practise live response run, putfile, getfile, and library commands. In Microsoft Entra ID Protection, confirm a user compromised; in Microsoft Purview, compare eDiscovery (Premium), Content Search, and Audit (Premium); and read how automatic attack disruption contains an active attack autonomously.

5. Drill KQL and threat hunting

   Week 3

   Write Advanced Hunting KQL daily. Learn the table map: DeviceProcessEvents for process lineage, DeviceNetworkEvents for connections, DeviceEvents as the general table. Build make-series for beaconing and prove summarize with bin drops empty buckets. Capture a hunting bookmark, tag it with ATT&CK, and add it to an incident. Run a Jupyter Notebook with MSTICPy and read how the Microsoft Sentinel MCP Server authenticates through Microsoft Entra ID.

6. Drill weak domains and space the review

   Week 4

   Use your per-domain accuracy on practice questions to attack the domains dragging you down rather than re-reading what you already know. Revisit each domain's recall prompts after a few days and again a week later, because spacing roughly doubles what sticks compared with cramming. Pay extra attention to the management domain, since it is the heaviest weighted.

7. Sit a timed mock and calibrate

   Week 4 to 5

   Take at least one full timed practice run to rehearse pacing and the flag-and-return habit. Treat the score as a per-domain readiness signal rather than one number, and review every missed question, naming the constraint in the stem you misread such as real-time versus scheduled or the wrong telemetry table, before you book or sit.

Frequently asked questions