SC-200: Microsoft Security Operations Analyst Exam Prep

About this course

This course prepares you to earn the Microsoft Security Operations Analyst (SC-200) certification with a practical approach. You’ll map every module to the latest skills measured for the exam, including managing a security operations environment, configuring protections and detections, managing incident response, and managing security threats. These are the same four domains Microsoft lists for SC-200, and they guide the structure, labs, and review checkpoints throughout the course.Across the modules, you’ll work directly with the Microsoft security stack you’re tested on: Microsoft Defender XDR (covering Defender for Endpoint, Identity, and Office 365), Microsoft Defender for Cloud for cloud workload protection, and Microsoft Sentinel for SIEM/SOAR. You’ll also practice KQL-based threat hunting, incident triage, automation rules, and playbooks so you can respond with confidence on exam day and in real SOC work.What you’ll learn:How modern SOCs evolve from traditional tooling to unified Defender XDR and Sentinel, with hands-on configuration, tuning, and alert workflows.Endpoint detection and response with Defender for Endpoint: onboarding, advanced features (EDR in block mode, live response), device timelines, and automated investigation.Identity and email defenses with Defender for Identity and Defender for Office 365, including policies, DLP signals, and incident investigation in the Microsoft Defender portal.Cloud posture and workload protection with Defender for Cloud, from discovering unprotected resources to mitigating risks surfaced by vulnerability and exposure management.Microsoft Sentinel deployment and operations: workspace design, data collection rules, Content Hub solutions, analytics rules, workboo