SC-200 Practice Tests: Security Operations Analyst 2026
500 questions on Defender XDR, Microsoft Sentinel, incident response and KQL hunting, every answer option explained
Are you ready for SC-200, or do you only think you are? This practice set shows whether you can apply them under exam conditions, and where the gaps are before you book the exam.
This practice set contains five practice tests with 100 questions each: 500 questions in total, written for the SC-200 skills outline that applies from October 21, 2026. Every test follows the official domain weights: Manage a security operations environment (42 questions), Respond to security incidents (36) and Perform threat hunting (22).
SC-200 has changed a lot. The April 2026 revision replaced the old four-domain outline with three domains and added the Microsoft Sentinel data lake and its retention tiers, KQL jobs, summary rules, Sentinel graph, hunting graphs with blast radius, the Sentinel MCP server, custom data collection in Defender for Endpoint and case management in the Defender portal. Practice material written for the older SC-200 outline still asks about Microsoft 365 Defender, Fusion rules and Sentinel in the Azure portal, and prepares you for an exam that no longer exists.
The five tests get harder step by step:
- Test 1, Groundwork: one concept per question, to find your baseline.
- Test 2, In Practice: short SOC scenarios with features that are easy to mix up.
- Test 3, Trade-offs: two answers look right and one condition decides.
- Test 4, Under the Hood: settings, limits, exact role names, portal paths and KQL output.
- Test 5, Exam Day: long multi-constraint scenarios at the pace of the real SC-200 exam.
Every answer option has its own explanation, so you also learn why the wrong options are wrong and what those features actually do. Each question ends with a general explanation and a link to the Microsoft Learn page it is based on.
After each attempt, PrepKiwi shows your score per domain, so you know where to focus your revision. The passing mark is 80% for tests 1 to 4 and 85% for test 5, higher than the real exam, because practising at home is easier than sitting a proctored exam.
What this practice set is not: it is not a video course, not a collection of real exam questions, and not a replacement for the Microsoft Learn learning paths or hands-on practice. It is a way to test what you know and to learn from every mistake.
Groundwork: Core Defender XDR and Sentinel Concepts
100 questions · 165 minutes · pass mark 80%
Start here to find your baseline. These 100 questions cover every part of the SC-200 skills outline (October 21, 2026): configuring Defender XDR and Microsoft Sentinel, responding to incidents, and threat hunting with KQL. Most questions check one concept at a time, for example which role, table, connector or setting fits a short requirement, so you can see quickly which domains you already know. You have 165 minutes, which is generous on purpose. The passing mark is 80%. That is stricter than the real exam's 700 out of 1000, because a practice test at home is easier than a proctored exam and a margin gives you more certainty on exam day. Every answer option has its own explanation, and each question ends with a link to the Microsoft Learn page it is based on.
In Practice: Everyday SOC Scenarios
100 questions · 165 minutes · pass mark 80%
The second test puts the same domains into short, practical SOC scenarios. An alert arrives, a table needs data, an incident needs the right response action: which feature, role or step do you choose? Many questions set two neighbouring features against each other that are easy to mix up, such as automation rules and playbooks, leftsemi and leftanti joins, or has and contains in KQL. The question count and domain split are the same as in test 1, so your scores per domain are directly comparable. You have 165 minutes and need 80% to pass. Read the explanation of every option, also when you answered correctly: the wrong options teach you what the neighbouring feature actually does.
Trade-offs: When Two Answers Look Right
100 questions · 165 minutes · pass mark 80%
In this test, two answers often look right. One condition in the question decides: least privilege, the retention tier, the portal, the licence, the data source or the time window. This is how many real SC-200 questions are built, and it is where candidates who learned only definitions lose points. Read the whole stem before you look at the options and underline the constraint for yourself. The questions are longer than in tests 1 and 2, and the clock stays at 165 minutes, so you have less thinking time per question. The passing mark is 80%. The explanations show which condition tipped the balance and why the other plausible option fails it.
Under the Hood: Settings, Limits, Roles and KQL
100 questions · 135 minutes · pass mark 80%
This test goes into the details: parameter values, limits, exact role names, navigation paths in the Microsoft Defender portal, the order of steps, data collection rules, XPath filters and the output of KQL queries. Questions are short but precise, so you get 135 minutes and need 80% to pass. If a number or setting name catches you out, look it up via the linked Microsoft Learn page and try it in a lab tenant if you can. Memorising alone rarely sticks for this kind of material. Your domain report will show whether the gaps sit in automation, the Sentinel platform, incident response or hunting.
Exam Day: Full-Length Simulation
100 questions · 160 minutes · pass mark 85%
Take this test last, in one uninterrupted sitting, as a readiness check. The 100 questions have the longest scenarios in this practice set: fictional companies, several constraints per question, and domains mixed within one case. You have 160 minutes, the least thinking time per question of all five tests. The passing mark is 85%, higher than the other tests. The real exam reports a scaled score of 700 out of 1000, and a practice test at home is still easier than a proctored exam, so you want a clear margin here. If you score below 85%, go back to your weakest domain, reread the explanations, and retake the test after a few days rather than immediately.
What you will practice
- Test your readiness for SC-200 with 500 questions aligned to the skills outline of October 21, 2026
- Configure Defender XDR and Sentinel automation: ASR rules, AIR, attack disruption, automation rules and playbooks
- Pick the right connector, DCR, retention tier, table and role for Sentinel ingestion, detections and hunting
- Distinguish response actions for incidents from Defender for Endpoint, Office 365, Identity, Cloud Apps and Entra ID
- Learn from explanations for every answer option, each question linked to the Microsoft Learn page it is based on
- Build from single-concept questions to a full-length simulation with the pace and scenario length of the real exam
- Read and predict KQL: joins, summarize with bin, make-series, has versus contains, and the right Advanced Hunting table
- Find your weak domain with per-domain scores after each attempt and focus your revision where it counts
Exam domains covered
Who is this for
This practice set is for security analysts, SOC engineers and IT administrators who are preparing for Exam SC-200: Microsoft Security Operations Analyst, and for people moving into a SOC role from infrastructure, Microsoft 365 administration or cloud engineering. It also suits students and career changers who have worked through the Microsoft Learn material and want to know whether it has stuck, and team leads who want a quick check of their analysts' knowledge of Defender XDR and Microsoft Sentinel. The questions follow the skills outline that applies from October 21, 2026, with the Sentinel data lake, KQL jobs, summary rules, Sentinel graph, automatic attack disruption and case management in the Defender portal. If your study material still uses the older four-domain outline or talks about Microsoft 365 Defender and Sentinel in the Azure portal, these tests show you where it falls short. This is a practice set: it tests your knowledge and explains every answer, but it does not replace a full training course or hands-on experience.
Requirements
- Working knowledge of Microsoft 365 and Azure, and basic familiarity with security operations. You do not need to be a KQL expert: the tests explain the operators they use.
- These are practice exams that test and explain. Use them alongside the free Microsoft Learn learning paths for SC-200 and, ideally, a lab tenant, not instead of them.
- No paid tools required. Access to a Microsoft 365 E5 or Defender trial helps you try out what you read in the explanations.
Free exam guide
Not sure what to expect? Read how the exam is built, what it covers and how to prepare.