RoleMath Study Track for Microsoft Security Operations Analyst Associate (SC-200) (SC-200)

Module 1 of 3 · domain 1 · 40-45% of the exam

Manage a security operations environment

Study this first. At 40-45% it is the heaviest domain, and it is the scaffolding for everything else: you cannot triage incidents or hunt across data you have not first ingested, normalized, and wired into detections. This is where you stand up Microsoft Sentinel, connect data sources, and author analytics rules.

What this domain actually covers

Plain-language explanation in our own words — paraphrased from, and checked against, the official objectives. Microsoft SC-200 study guide

This is the 'stand up and run the SOC's tooling' domain, and Microsoft weights it at 40-45% - by far the heaviest slice of SC-200. It is the plumbing the whole job depends on: before an analyst can respond to an incident or hunt for a threat, someone has to ingest the data, normalize it, wire up detections, and keep the platform healthy. Because it is both the largest domain and the foundation the other two build on, we study it first and give it the most time. Unlike the fundamentals exams, this is genuinely hands-on: the skills are configuring Microsoft Sentinel and Microsoft Defender XDR, not describing them, so plan to spend real time in a workspace you own.

Automation across Microsoft Defender XDR and Microsoft Sentinel is the efficiency layer, and the exam expects you to reason about it. In Microsoft Sentinel, automation rules govern how incidents are handled at scale - assigning owners, setting severity, suppressing noise, or triggering a playbook - while playbooks (built on Azure Logic Apps) carry out the actual response steps such as enriching an alert, opening a ticket, or notifying a channel. In Defender XDR, automated investigation and response can triage and remediate common alerts without human effort. The through-line the exam rewards is knowing when to let automation handle a repeatable, high-confidence reaction and when a human analyst must stay in the loop, so that the SOC scales without acting blindly.

Configuring Microsoft Sentinel as a SIEM is the domain's centerpiece. Sentinel is Microsoft's cloud-native SIEM and SOAR platform, and this domain covers the operational setup: creating and configuring the Log Analytics workspace it runs on, managing roles and permissions so the right people can read, respond, and administer, setting data retention to balance investigation needs against cost, and using workbooks to visualize the estate. SOC optimization recommendations help you tune coverage and spend over time. The mental model to carry is that Sentinel centralizes signals from across the environment so a pattern invisible in any single source becomes visible - and that this power depends entirely on how well you configure the workspace, connectors, and analytics beneath it.

Data ingestion is where a SIEM lives or dies, and the exam probes the connector landscape in depth. Data connectors bring signals in: native connectors for Microsoft and major cloud services, and agent-based collection for the rest - the Azure Monitor Agent (AMA) gathering Windows and Linux events, and Syslog and Common Event Format (CEF) for network devices, firewalls, and third-party appliances. You should also recognize threat-intelligence connectors that import indicators of compromise, and the ability to define custom tables and transform data at ingestion so it lands in a usable, cost-aware shape. The recurring skill is matching a data source to the right connector and understanding that what you ingest - and how you normalize it - sets the ceiling on what you can later detect and hunt.

Detections and analytics rules turn raw data into incidents, and this is the domain's analytical heart. Scheduled analytics rules run KQL queries on a cadence to spot known-bad patterns; near-real-time (NRT) rules fire with minimal delay for time-sensitive conditions; and Microsoft-provided rule templates and the content hub give you a running start. Crucially, the exam expects you to think about detections in terms of the MITRE ATT&CK framework: mapping your analytics rules to ATT&CK tactics and techniques lets a SOC measure and close coverage gaps rather than guessing whether it can see a given adversary behavior. When a rule fires, it produces an alert that groups into an incident - the object Domain 2 then investigates - so this domain quite literally manufactures the work the rest of the exam handles.

Study this domain by standing up a real, safe SIEM and touching every layer of it, because SC-200 rewards configuration skill over recall. The lab below deploys the Microsoft-published Sentinel Training Lab into a free Azure subscription you own using the Sentinel 30-day free trial: you enable Sentinel on a Log Analytics workspace, load the lab's simulated attack data, then tour the connectors, workspace retention, workbooks, analytics rules (scheduled versus NRT, with their MITRE ATT&CK mapping), and the incident queue - recording what you built in your own words. A hard billing boundary applies: use only a subscription you own, attach no large data source, and delete the workspace before the trial ends. As always, read the official SC-200 study guide for Microsoft's authoritative topic list; this explanation paraphrases its scope in our own words rather than reproducing it.

Learn it free

• Official · Official exam objectives
  Microsoft SC-200 study guideThe exam's own topic list for this domain - read its security-operations-environment section directly rather than relying on any summary, including ours. (captured 2026-07-11)
• Official · Free official training
  SC-200: Configure your Microsoft Sentinel environment (free learning path)Microsoft's own free, self-paced Learn path covering the Sentinel workspace, roles, connectors, and analytics rules that anchor this domain; verify the free label on the page before relying on it. (captured 2026-07-11)
• Official · Free official hands-on lab
  Microsoft Sentinel Training Lab (official, deploy-it-yourself)The Microsoft-published Sentinel Training Lab with simulated attack data, deployed into a free Azure trial you own; the hands-on ground for this domain - mind the billing boundary and delete the workspace before the trial ends. (captured 2026-07-11)

Check yourself

3RoleMath-original concept checks for this domain — written by us against cited public sources, never taken from any exam. They confirm understanding; they don’t predict a pass.

Module 2 of 3 · domain 2 · 35-40% of the exam

Respond to security incidents

Study this second. At 35-40% it is the second-heaviest domain and the analyst's daily work: investigating and remediating across Microsoft Defender XDR (endpoint, identity, email, cloud apps, and cloud), across Sentinel incidents, and increasingly with an embedded Security Copilot agentic-AI assistant.

What this domain actually covers

Plain-language explanation in our own words — paraphrased from, and checked against, the official objectives. Microsoft SC-200 study guide

This is the 'do the analyst's job' domain, and Microsoft weights it at 35-40% - the second-largest slice of SC-200. Where Domain 1 built the SIEM, this domain is about working the incidents that SIEM produces: triaging them, investigating across every layer of the Microsoft security portfolio, taking remediation actions, and closing cases defensibly. It is the most tool-diverse domain on the exam, because a real incident rarely stays in one product - a single attack can touch an endpoint, an identity, a mailbox, a cloud app, and a cloud workload at once - so the skill it tests is investigating a correlated incident across all of them rather than juggling separate consoles.

Responding across Microsoft Defender XDR is the domain's backbone, and you should be able to work each component in an incident. Defender for Endpoint handles device detection and response - timelines, live response sessions, investigation packages, and attack-disruption actions; Defender for Office 365 handles email and collaboration threats; Defender for Identity surfaces on-premises Active Directory attack signals; Defender for Cloud Apps governs SaaS visibility and control; Microsoft Entra ID Protection contributes risky-user and risky-sign-in signals; and Defender for Cloud brings cloud-workload alerts and posture findings into the picture. Microsoft Purview adds the data-security and investigation surface - Audit, eDiscovery, and activity signals. The exam skill is mapping an entity in an incident to the product that owns its deepest signal and knowing what response action each product offers.

The unified incident experience is what ties the portfolio together, and it is heavily tested. Microsoft Defender XDR correlates alerts from across endpoints, identities, email, and cloud apps into a single incident with one investigation graph, so an analyst reasons about one coordinated attack rather than a scatter of alerts. You should be fluent in the incident queue: reviewing entities and evidence, following the investigation graph, pivoting from one entity to its related activity, assigning severity and ownership, and understanding how multi-stage attacks are stitched together. Attack disruption - automatically containing an in-progress attack by isolating a device or suspending an account - is a capability to recognize. The clean idea to carry is that XDR turns many alerts into one investigable incident, and your job is to drive that incident to a decision.

Case management and the newest capability - agentic AI with an embedded Security Copilot - are where this domain has grown, and the July 2026 update makes them examinable. Sound case management means documenting your work as you go: adding comments and tasks, assigning owners, and classifying and closing an incident as a true positive, benign positive, or false positive with a justification the next analyst can trust. Layered on top, Microsoft Security Copilot brings generative and increasingly agentic AI into the investigation - summarizing an incident, suggesting next steps, and running embedded investigation experiences inside the Defender and Sentinel portals. The judgment the exam rewards is treating the AI assistant as an accelerant that drafts and enriches, while a human analyst still governs the decision to contain, remediate, or close - the AI proposes, the analyst disposes.

Microsoft Sentinel incidents and cross-signal investigation round out the domain and connect it back to Domain 1. When your Sentinel analytics rules fire, they produce incidents in Sentinel's own queue, and responding there means investigating entities, running playbooks and automation rules for consistent enrichment and response, and correlating Sentinel's broad, multi-source view with the deep, endpoint-and-identity-rich view Defender XDR provides. The recurring skill is knowing which console to reach for: Defender XDR for a deep, correlated first-party incident, and Microsoft Sentinel for a wide-angle view that folds in third-party and custom data. A capable analyst moves fluidly between them and standardizes the routine parts of response with automation so their attention goes to the judgment calls.

Study this domain by driving a real incident from the queue to a defensible close, because SC-200 tests what you would do, not what you can name. The lab below takes one of the incidents the Sentinel Training Lab generated in the same free trial workspace you own and runs it through the RoleMath incident-triage worksheet: you triage and set severity, follow the investigation graph and pivot on entities, map each entity type to the Defender product that owns it, add comments and tasks, optionally compare a Security Copilot summary to your own read, then classify and close with a justification and note what you would feed back into detections. All actions are taken only against the synthetic lab entities, never a real system, and the trial's billing boundary still applies. As always, read the official SC-200 study guide for Microsoft's authoritative topic list; this explanation paraphrases its scope in our own words rather than reproducing it.

Learn it free

• Official · Official exam objectives
  Microsoft SC-200 study guideThe authoritative topic list for this domain's incident-response coverage - read it directly rather than relying on any summary, including ours. (captured 2026-07-11)
• Official · Free official training
  SC-200: Mitigate threats using Microsoft Defender XDR (free learning path)Microsoft's own free, self-paced Learn path covering incident investigation and response across the Defender XDR portfolio for this domain; verify the free label on the page before relying on it. (captured 2026-07-11)
• Official · Free official training
  SC-200: Mitigate threats using Microsoft Defender for Endpoint (free learning path)Microsoft's own free path on device detection and response - timelines, live response, and investigation packages - a core part of responding to endpoint entities in an incident; verify the free label before relying on it. (captured 2026-07-11)
• Official · Free official training
  SC-200: Mitigate threats using Microsoft Security Copilot (free learning path)Microsoft's own free path on the embedded Security Copilot agentic-AI assistant added to the response domain in the July 2026 update; verify the free label before relying on it, and reconcile it against the current study guide. (captured 2026-07-11)

Check yourself

2RoleMath-original concept checks for this domain — written by us against cited public sources, never taken from any exam. They confirm understanding; they don’t predict a pass.

Module 3 of 3 · domain 3 · 20-25% of the exam

Perform threat hunting

Study this last. At 20-25% it is the smallest slice by weight and the most naturally studied last: proactive KQL hunting in Defender XDR Advanced Hunting and in Microsoft Sentinel is most meaningful once you already understand the data sources (Domain 1) and what a real incident looks like (Domain 2).

What this domain actually covers

Plain-language explanation in our own words — paraphrased from, and checked against, the official objectives. Microsoft SC-200 study guide

This is the 'go find what the detections missed' domain, and Microsoft weights it at 20-25% - the smallest slice of SC-200, but the one that most distinguishes a proactive analyst from a reactive one. Where Domain 2 responds to incidents that fired, threat hunting starts from a hypothesis - a threat report, an ATT&CK technique, an anomaly - and queries the raw telemetry to confirm or refute it before an alert ever exists. We study it last because a good hunt is grounded in the data sources you configured in Domain 1 and the incident patterns you learned in Domain 2; hunting in a vacuum, without that context, teaches syntax but not judgment. The skill the exam rewards is fluent KQL applied with a clear question in mind.

KQL threat hunting in Microsoft Defender XDR Advanced Hunting is the domain's first pillar. Advanced Hunting exposes a rich schema of tables - device process and network events, identity logon events, email events, and more - that you query with the Kusto Query Language to find rare or suspicious behavior across the estate. You should be comfortable scoping a query to the right table, filtering and projecting the fields that matter, summarizing to surface outliers, and joining tables to follow an entity across signal types. Threat analytics reports give you Microsoft-curated context on active threats to hunt for, and a strong hunt can be promoted into a custom detection so the finding is caught automatically next time. The recurring idea is that Advanced Hunting turns 'I wonder if we were affected by X' into a concrete, answerable query.

Sentinel Graph and entity relationships - new in the July 2026 update - are the domain's newest capability, and worth recognizing. Beyond querying a single table, Sentinel Graph lets you traverse the relationships between entities: a user to the devices they signed into, those devices to the processes they ran, those processes to the network destinations they reached. Reasoning over that graph surfaces attack chains that a table-by-table query would miss, because the signal is in how the entities connect, not in any one row. The exam skill here is conceptual as much as syntactic: understanding that a graph view of entity relationships is a different and complementary way to hunt, letting an analyst follow an adversary's path rather than inspecting isolated events.

Threat hunting in Microsoft Sentinel is the domain's second pillar and pulls together the broad, multi-source view. Sentinel provides purpose-built hunting queries you can run and customize, bookmarks to save interesting results as you go, and the ability to run KQL jobs against larger data - including data in a data lake or archive tier - so cost-effective retrospective hunts over long time ranges become possible. Summary rules pre-aggregate high-volume data to make hunting and detection cheaper, and notebooks (with the supporting tooling and, increasingly, MCP-server integration) let advanced analysts hunt with the full power of a data-science environment. The clean distinction to carry is that Defender XDR Advanced Hunting is deep on first-party endpoint and identity signal, while Sentinel hunting spans the wide, multi-source estate and scales to long-horizon, large-data hunts.

Study this domain by building the KQL muscle safely and then applying it where the data lives, because SC-200 tests hunting you can actually perform. The lab below is two-tier: Tier A uses the Kusto Detective Agency game and the Azure Data Explorer sample playground to practice core KQL operators - where, project, summarize, extend, join, let, and time-binning - on public sample data with NO tenant, no account, and no cost; Tier B applies that KQL in the same free Sentinel/Defender workspace you own, running a SecurityEvent failed-logon hunt, touring the Advanced Hunting schema, noting how Sentinel Graph traverses entity relationships, and saving a Sentinel hunting query - all read-only except the query you save in your own workspace, and inside the trial's billing boundary. As always, read the official SC-200 study guide for Microsoft's authoritative topic list; this explanation paraphrases its scope in our own words rather than reproducing it.

Learn it free

• Official · Official exam objectives
  Microsoft SC-200 study guideThe authoritative topic list for this domain's threat-hunting coverage - read it directly rather than relying on any summary, including ours. (captured 2026-07-11)
• Official · Free official hands-on practice
  Kusto Detective Agency (official KQL practice game, no tenant needed)Microsoft's free KQL game on public sample data - the safest, no-cost way to build the query muscle threat hunting depends on before you touch a real workspace; no account or tenant required. (captured 2026-07-11)
• Official · Free official practice questions
  Microsoft SC-200 practice assessment (official, free)Microsoft's own free interactive practice assessment for SC-200, useful across all three domains to check familiarity with the question style; the pool is finite and recycles, so treat it as a readiness check rather than a coverage guarantee. (captured 2026-07-11)

Check yourself

2RoleMath-original concept checks for this domain — written by us against cited public sources, never taken from any exam. They confirm understanding; they don’t predict a pass.