SC-200 Domains Explained

The short version

SC-200 has three domains: Manage a security operations environment (40-45%), Respond to security incidents (35-40%), and Perform threat hunting (20-25%). The topic lists below follow Microsoft’s “Skills measured as of October 21, 2026”. Microsoft says the bullets illustrate how a skill is assessed and that related topics may appear. The traps and practice tips are our own advice, not vendor statements.

Domain 1: Manage a security operations environment (40-45%)

This domain is about the plumbing of a SOC. It has four parts.

Configure automation for Defender XDR and Microsoft Sentinel. Microsoft lists email and alert notifications, alert tuning and suppression, Defender for Endpoint advanced features, rule settings, custom data collection, security policies including attack surface reduction (ASR) rules, automated investigation and response, automatic attack disruption, device groups with permissions and automation levels, and Sentinel automation rules and playbooks.

Configure the Sentinel SIEM and platform. Sentinel roles, data retention for tables across the Analytics, Data lake, and XDR tiers, workbooks, and optimizing the platform with SOC optimization recommendations.

Ingest data. Choosing connectors, collecting Windows Security events through the Azure Monitor Agent (AMA) and data collection rules, planning Windows Event Forwarding, Syslog and Common Event Format (CEF) via AMA, Azure activity logs through Azure Policy and diagnostic settings, threat indicators, and custom log tables.

Configure detections. Custom detection rules built on advanced hunting, managing them, Sentinel analytics rules (scheduled, near-real-time, threat intelligence, and machine learning), ATT&CK coverage analysis, and anomalies.

Common traps.

Roles: questions describe a person and ask for the least privilege that works. Know what Reader, Responder, and Contributor can each do in Sentinel.
Connectors and tables: two collection methods can look alike but land data in different tables. Learn which connector feeds which table.
Automation rule or playbook: one decides when and what to do in Sentinel, the other runs a workflow. Learn which job each one fits.
Retention tiers: be able to explain why data would sit in the Analytics, Data lake, or XDR tier.

What to practice. Create a data collection rule, enable a connector, write a scheduled analytics rule, and build one automation rule and one playbook. Turn an advanced hunting query into a custom detection.

Domain 2: Respond to security incidents (35-40%)

This domain asks what you would do when something fires.

Defender XDR alerts and incidents. Microsoft lists investigating and remediating threats from Defender for Office 365, Purview, Defender for Cloud workload protections, Defender for Cloud Apps, Entra ID, Defender for Identity, and Sentinel. It also lists investigating with agentic AI including embedded Security Copilot, handling complex multi-stage and lateral-movement attacks, and managing incidents with case management.

Defender for Endpoint. Device timelines, actions on the device including live response and investigation packages, evidence and entity investigation, and incidents from automatic attack disruption.

Microsoft 365 activity. Purview Audit, content search in Purview eDiscovery, and Microsoft Graph activity logs.

Common traps.

Response actions that sound alike. Isolating a device, containing a device, and restricting app execution do different things. Know which one keeps network access.
Source of the alert. A compromised identity, a risky app, and a malicious email each belong to a different product and a different set of actions.
Which portal or log answers the question: Audit, eDiscovery, or Graph activity logs.

What to practice. Work a sample incident end to end in the Defender portal. Open a device timeline, find the response actions, and read an incident’s attack story.

Domain 3: Perform threat hunting (20-25%)

Detect threats with Defender XDR. Microsoft lists choosing the right table for a KQL query, finding threats with KQL, creating advanced hunting queries, interpreting threat analytics, creating hunting graphs including blast radius, and analyzing entity relationships with Sentinel Graph.

Detect threats with the Sentinel platform. Creating and monitoring hunting queries, creating and managing KQL jobs in the data lake, creating and managing summary rule tables, and hunting with notebooks, including a connection to the Sentinel MCP Server.

Common traps.

Table choice. Many questions come down to knowing which advanced hunting table holds files, processes, network connections, logons, or email events.
Operators that look similar: join versus union, project versus extend, summarize versus count, has versus contains.
Where a query is allowed to run: advanced hunting, Sentinel logs, or data lake queries, which can differ in what they can reach.

What to practice. Write queries daily for two weeks. Start from a plain English question (“which accounts failed to sign in more than ten times?”) and translate it into KQL.

Where to spend your time

Domains 1 and 2 add up to about 75 to 85 percent of the exam, so most of your hours belong there. Domain 3 is smaller, but KQL skills also help in Domains 1 and 2, when you read detections and tune alerts.

More guides for SC-200

Next step

Put the domain list into a schedule with the study plan. To see how the domains turn into questions, try the sample questions or the SC-200 practice tests.

Frequently asked questions

Which domain should I study first?

Start with Domain 1, because the connectors, tables, and detections it covers are what the rest of the exam builds on.

Do I need to memorize licensing?

The skills outline does not list licensing, but some questions may mention which product or plan provides a feature. Learn the product names and which workload each one covers.

Are preview features tested?

Microsoft says most questions cover generally available features, though preview features may appear if they are commonly used.

Try the SC-200 practice exams