عراب ال IT 
امتحانات دوليه
SC-200 Microsoft Security Operations Analyst
About the Certification
This is a specialization certification at the Security Operations Analyst level. It focuses on threat detection, security incident investigation, and incident response using Microsoft security tools such as Microsoft Sentinel and Microsoft Defender. The certification aims to prepare professionals to work effectively within Security Operations Centers (SOC) in a professional and structured manner.
Main Curriculum
The curriculum is divided into four major parts
- Threat Detection Using Microsoft Sentinel
-
- Sentinel configuration
- Data connectors
- Kusto Query Language (KQL)
- Analytics rules
- Hunting queries
- Monitoring Hybrid Environments
-
- Protection of cloud and on-premises devices
- Data source integration
- SIEM and XDR integration
- Security Incident Investigation and Response
-
- Incident response
- Alert investigation
- Automation rules
- Playbooks using Logic Apps
- Security Management Using Microsoft Defender
-
- Microsoft Defender for Endpoint
- Microsoft Defender for Identity
- Microsoft Defender for Office 365
- Threat and vulnerability management
Exam Details
- Exam code: SC-200
- Duration: 120 minutes
- Number of questions: 40–60
- Question types: Multiple choice, scenario-based questions, and drag-and-drop
- Language: English
- Passing score: 700 out of 1000
- Exam fee: USD 83–165 (may vary by country and may include taxes in some regions)
- Certification Validity The certification is valid for one year, with free annual renewal through Microsoft Learn.
Do I need any certifications before it ?
No prerequisites are required. However, having basic security knowledge is recommended. Familiarity with Azure Active Directory and Microsoft 365 will significantly ease the learning process, and basic exposure to KQL is considered an advantage, although it is covered within the curriculum.
Which certifications are recommended after this one ?
Not mandatory. However, for those seeking a strong career path in Microsoft security operations particularly threat detection, investigation, and incident response using Microsoft Sentinel and Defenderthe SC-200 Microsoft Security Operations Analyst certification represents the strongest foundation.
What are the main uses of the SC-200 certification ?
- SC-300 — Identity and Access Administrator: To deepen expertise in identity and access management.
- SC-400 — Information Protection Administrator: For specialization in data protection and governance.
- SC-100 — Cybersecurity Architect Expert: The highest-level security certification within Microsoft.
- AZ-500 — Azure Security Engineer: For deeper specialization in cloud security.
Your First Step Toward the Security Operations Center (SOC) :
This certification provides a strong foundation for working as a Security Operations Analyst. It enables professionals to detect threats and respond to incidents using Microsoft Sentinel and Microsoft Defender, and opens a clear path toward advanced cybersecurity specializations.
Who is this certification suitable for ?
- Professionals working or aiming to work in a Security Operations Center (SOC).
- Individuals interested in threat analysis, incident response, and security monitoring.
- Professionals planning to pursue a security career path within Microsoft Cloud.
- You intend to continue the security track within Microsoft Cloud.