Skip to content
Cheat sheets
Associate · SC-200Prep available

Microsoft Certified: Security Operations Analyst Associate (SC-200) practice exam and study path

A free, timed 60-question SC-200 practice exam in 100 minutes, scored by domain, with every option explained after you submit. Also 96 practice questions you can check one at a time, a page for every task in the exam guide, and a study path. No sign-up.

Start the free practice examGet the exam packPractise question by question →
Security Operations Analyst Associate exam pack:

$6.99for 12 months

For security operations analysts who run Microsoft Defender XDR and Microsoft Sentinel in the Defender portal: automation and detections, data connectors, tiers and retention, incident response across Defender workloads, Entra ID and Purview, and threat hunting with KQL, the data lake and graphs.

The exam

Exam code
SC-200
Questions
Not yet published
Time
100 minutes
Passing score
700 of 1,000 (scaled)
Exam fee
$165 (USD)
Question types
multiple choice, multiple response

Exam SC-200 is a proctored role-based exam: 100 minutes, offered in ten languages through Pearson VUE, it may include interactive components, and 700 passes. Microsoft doesn't publish the number of questions (most of its exams have 40 to 60). The fee is set by the country or region (USD 165 in the United States, the price of Microsoft's SC role-based exams), and the certification renews every year with a free online assessment. The skills measured were updated on October 21, 2026. Our forms use 60 questions split 25 / 22 / 13, close to the midpoints of the guide's ranges.

From Microsoft's certification page and exam guide, checked Oct 25, 2026.

Domains and weights

  • Domain 1: Manage a security operations environment

    41%

  • Domain 2: Respond to security incidents

    37%

  • Domain 3: Perform threat hunting

    22%

On our roadmap this comes after Azure Fundamentals. See every certification.

Practice

96 original practice questions, every option explained with the Microsoft documentation page that proves it. Free, no sign-up; progress stays on this device.

Your results on this device →

More practice exams

The lessons, the sample questions on every task page and the first full practice exam are free and stay free. A pack adds the further timed SC-200 practice exams.

Security Operations Analyst Associate exam pack

$6.99for 12 months

  • Every paid SC-200 practice exam, timed, with every option explained
  • The next version of this exam included when it changes within your 12 months
  • 12 months of access. One payment, nothing renews by itself.
  • 14-day refund, no conditions
  • 14-day refund, no conditions: ask within 14 days of buying and you get the whole payment back.
  • No pass guarantee. These are practice exams written by us from the exam guide and the Microsoft documentation; a score here does not predict your result on the real exam.

Study path

One module per exam domain. Lessons that already exist on BytePatterns are linked; the rest are being written.

  1. Module 1: Manage a security operations environment

    1. 1Email notifications in Defender XDR: incidents, response actions and threat analyticsTask 1.1

      Lesson coming

    2. 2Alert tuning, suppression and detection rule correlation settingsTask 1.1

      Lesson coming

    3. 3Defender for Endpoint advanced features, rules, indicators and custom data collectionTask 1.1

      Lesson coming

    4. 4Attack surface reduction rules and endpoint security policiesTask 1.1

      Lesson coming

    5. 5Automated investigation, device groups, permissions and automation levelsTask 1.1

      Lesson coming

    6. 6Automatic attack disruption: actions, prerequisites and exclusionsTask 1.1

      Lesson coming

    7. 7Sentinel automation rules and Logic Apps playbooksTask 1.1

      Lesson coming

    8. 8Sentinel roles, Defender unified RBAC and row-level scopingTask 1.2

      Partly covered by: Shared Responsibility & IAM

    9. 9Analytics, data lake and XDR tiers: retention, cost and table settingsTask 1.2

      Lesson coming

    10. 10Workbooks and SOC optimization recommendationsTask 1.2

      Lesson coming

    11. 11Choosing connectors: Windows Security Events via AMA and Windows Event ForwardingTask 1.3

      Lesson coming

    12. 12Syslog and CEF via AMA: log forwarders, facilities and duplicationTask 1.3

      Lesson coming

    13. 13Azure activity and resource logs through diagnostic settings and Azure PolicyTask 1.3

      Lesson coming

    14. 14Threat intelligence: Defender Threat Intelligence, TAXII and the upload APITask 1.3

      Lesson coming

    15. 15Custom tables, data collection rules and the Logs Ingestion APITask 1.3

      Lesson coming

    16. 16Custom detections in Defender XDR: frequency, lookback, entities and actionsTask 1.4

      Lesson coming

    17. 17Sentinel analytics rules: scheduled, NRT, threat intelligence and machine learningTask 1.4

      Lesson coming

    18. 18MITRE ATT&CK coverage and customizable anomaliesTask 1.4

      Lesson coming

  2. Module 2: Respond to security incidents

    1. 19Email threats in Defender for Office 365: Explorer, AIR, ZAP and remediationTask 2.1

      Lesson coming

    2. 20Purview DLP and insider risk alerts in the Defender portalTask 2.1

      Partly covered by: Finding and Masking PII

    3. 21Defender for Cloud workload alerts and Defender for Cloud Apps risksTask 2.1

      Lesson coming

    4. 22Compromised identities: Entra ID Protection and Defender for IdentityTask 2.1

      Lesson coming

    5. 23Sentinel incidents in the Defender portal, multi-stage attacks and case managementTask 2.1

      Lesson coming

    6. 24Security Copilot in Defender: summaries, guided responses and agentsTask 2.1

      Partly covered by: Agents and Tools, The Tool-Use Loop

    7. 25Device timelines, evidence and entity investigationTask 2.2

      Lesson coming

    8. 26Device response actions: isolation, containment, live response and investigation packagesTask 2.2

      Lesson coming

    9. 27Incidents from automatic attack disruptionTask 2.2

      Lesson coming

    10. 28Purview Audit, eDiscovery content search and Graph activity logsTask 2.3

      Lesson coming

  3. Module 3: Perform threat hunting

    1. 29Advanced hunting tables and KQLTask 3.1

      Lesson coming

    2. 30Threat analytics reportsTask 3.1

      Lesson coming

    3. 31Hunting graph, blast radius and Sentinel graphTask 3.1

      Lesson coming

    4. 32Hunting queries, hunts and bookmarks in SentinelTask 3.2

      Lesson coming

    5. 33KQL jobs and summary rules in the data lakeTask 3.2

      Lesson coming

    6. 34Data lake notebooks and the Sentinel MCP serverTask 3.2

      Partly covered by: Agents and Tools, The Tool-Use Loop

Every task in the exam guide

The exam guide splits each domain into task statements. Each one has a page with a short summary, the lessons that teach it and open sample questions.

Domain 1: Manage a security operations environment

Domain 2: Respond to security incidents

Domain 3: Perform threat hunting

How these questions are made

  • Written by us from the exam guide's task statements and the Microsoft documentation — never from real exam content.
  • Every option carries its own explanation and a link to the Microsoft page that proves it.
  • A question enters a timed exam only after an independent check; until then it is a practice question.
  • Results are a plain percentage, per domain too — not an imitation of Microsoft's scaled score.

Questions about the SC-200 practice exam

Is the SC-200 practice exam free?
Yes. The full practice exam (60 questions, 100 minutes) is free with no sign-up, and so are the 96 practice questions, the task pages and the study path. Your attempts are saved in this browser, on this device.
How many questions does it have, and is it timed?
60 questions in 100 minutes: the real SC-200 pace, scaled to this form. When the time runs out, the exam is submitted as it stands.
Are the answers explained?
After you submit, not during: like the real exam, the timed exam gives no feedback until the end. Then you get your score overall and per exam domain, and every question with each option explained and a link to the Microsoft documentation page behind it. In practice mode an answer is explained as soon as you check it.
What does the Security Operations Analyst Associate exam pack add?
3 more timed practice exams (Practice exam 1: 60 questions, 100 minutes; Practice exam 2: 60 questions, 100 minutes; Practice exam 3: 60 questions, 100 minutes), each scored and explained the same way, and the next version of this exam if it changes within your 12 months. 12 months of access. One payment, nothing renews by itself. Everything above stays free. See the pack.
Can I get a refund?
Yes, with no conditions: ask within 14 days of buying and you get the whole payment back. The details are in the terms.
Is this an official Microsoft practice exam?
No. BytePatterns is not affiliated with, endorsed or sponsored by Microsoft. Every question is written by us from the public exam guide and the Microsoft documentation, never from real exam content, and a score here does not predict your result on the real exam. Microsoft lists its own preparation resources on its certification page.