SC-200 study guide · 2026

The 3 SC-200 domains, explained

3 domains and 9 official functional groups. Manage a security operations environment carries the most weight at 40–45%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 1 See all domains
Questions
40–60 (varies)
Time
100 minutes
Passing score
700 / 1000
Outline
Skills measured as of 21 October 2026 (current)

Exam blueprint

Bar widths follow the official weights, scaled to fit the bar. Weight ranges are drawn at their midpoint.

  1. 1 40–45%
  2. 2 35–40%
  3. 3 20–25%
  1. 1 Manage a security operations environment
  2. 2 Respond to security incidents
  3. 3 Perform threat hunting

All 3 domains

9 official functional groups 80–110 hrs suggested study

  1. Domain 01 40–45%

    Manage a security operations environment

    This is the largest SC-200 functional group. It covers setting up and running the analyst's environment: configuring automation across Defender XDR and Sentinel, building the Sentinel SIEM, ingesting the right data, and creating the detections that surface threats.

    Inside this domain

    • Configure automation for Microsoft Defender XDR and Microsoft Sentinel
    • Configure the Microsoft Sentinel SIEM and platform
    • Ingest data into the Microsoft Sentinel SIEM and platform
    • Configure detections

    Watch for Log Analytics agent

    Functional groups
    4
    Questions est.
    17–26
    Study time est.
    35–45 hrs
  2. Domain 02 35–40%

    Respond to security incidents

    This group is the heart of the SOC analyst role. It covers investigating and remediating alerts and incidents across Microsoft Defender XDR, Defender for Endpoint and Microsoft 365, including agentic AI with Security Copilot and complex multi-stage attacks.

    Inside this domain

    • Respond to alerts and incidents in Microsoft Defender XDR
    • Respond to alerts and incidents in Microsoft Defender for Endpoint
    • Investigate Microsoft 365 activities to identify threats

    Watch for Entra ID for on-premises

    Functional groups
    3
    Questions est.
    15–22
    Study time est.
    30–40 hrs
  3. Domain 03 20–25%

    Perform threat hunting

    Threat hunting is the proactive side of the SOC role. It covers detecting threats with KQL and Advanced Hunting in Defender XDR, and with hunting queries, Data lake jobs and Notebooks in Microsoft Sentinel. KQL ties the whole exam together.

    Inside this domain

    • Detect threats by using Microsoft Defender XDR
    • Detect threats by using the Microsoft Sentinel platform

    Watch for Wrong table

    Functional groups
    2
    Questions est.
    9–14
    Study time est.
    15–25 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 80–110 hrs of study.

  1. 1 Manage a security operations environment 40–45% · 35–45 hrs
  2. 2 Respond to security incidents 35–40% · 30–40 hrs
  3. 3 Perform threat hunting 20–25% · 15–25 hrs

Try one

Practice questionDomain 1: Manage a security operations environment

A security operations team needs to collect specific Windows Security event IDs from Azure virtual machines into Microsoft Sentinel, filtering out unneeded events to control cost. Which approach should they use?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Log Analytics agent

    Clue The task is collecting Windows events into Sentinel now.

  • Domain 2

    Entra ID for on-premises

    Clue The activity is in on-premises Active Directory or on domain controllers.

  • Domain 3

    Wrong table

    Clue The data needed is process versus network activity.

Other Cybersecurity certifications

Study guides for exams that overlap with SC-200.

Practise what you read

SC-200 domains: common questions

How many domains are in the SC-200 exam?

SC-200 has 3 domains with 9 official functional groups between them: Manage a security operations environment, Respond to security incidents and Perform threat hunting.

Which SC-200 domain carries the most weight?

Manage a security operations environment is the heaviest at 40–45%, followed by Respond to security incidents (35–40%). The lightest is Perform threat hunting (20–25%). Weights come from Microsoft's official outline.

What is the SC-200 exam format?

Questions: 40–60 (varies). Time allowed: 100 minutes. Passing score: 700 / 1000.

How long should I study for SC-200?

Our planning estimate is 80–110 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Manage a security operations environment, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows Skills measured as of 21 October 2026 (current), published by Microsoft. It was last reviewed in October 2026.

Domain names, weights and functional groups come from Microsoft's official outline (Skills measured as of 21 October 2026 (current)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.