Skip to content
The Incident Ledger

Certifications

SC-200 study plan for SOC beginners

A six-week plan to prepare for Microsoft's Security Operations Analyst exam: what to study each week, how to practice for free, and the KQL you need to know.

Published 3 min readBeginner

SC-200, the Microsoft Security Operations Analyst exam, is one of the most practical certifications for someone starting in a SOC. It does not ask you to memorize protocol headers. It asks whether you can investigate an incident in Microsoft Defender XDR, write a KQL query, and configure Microsoft Sentinel to detect and respond to threats.

That also makes it hard to pass by reading alone. This plan spreads the preparation over six weeks with about an hour a day, and puts hands-on practice in every week.

What the exam covers

The skills outline groups the exam into a few broad areas. At the time of writing they are: managing a security operations environment, configuring protections and detections, managing incident response, and managing security threats, which includes threat hunting.

In practice, that means three products and one language:

  • Microsoft Defender XDR, the portal where alerts from endpoints, email, identities and cloud apps become incidents.
  • Microsoft Sentinel, the SIEM where you connect data sources, write analytics rules and automate responses.
  • Microsoft Defender for Cloud, for protections and alerts on cloud workloads.
  • KQL (Kusto Query Language), which runs through all of them.

Before you start: set up a place to practice

Reading about an incident queue is not the same as working one. Create a free Azure account and a Log Analytics workspace with Microsoft Sentinel enabled, and follow the Microsoft Learn exercises that come with each module. Many of them provide a lab environment so you do not have to build one yourself.

The six-week plan

  1. Week 1: SOC foundations and the Defender XDR portal

    Learn how an incident is built from alerts, how to assign and classify it, and where to find the evidence and the timeline. Spend time simply clicking through the portal until you can find any alert's device, user and related emails without searching.

  2. Week 2: KQL from zero

    Learn where, project, summarize, extend, join and time filters. Practice on the Microsoft Learn sample data until you can write a query from an English sentence such as "failed sign-ins per user in the last day".

  3. Week 3: Defender for Endpoint, Office 365 and Identity

    Defender for Endpoint is Microsoft's EDR. Focus on what each product detects, how you respond from the portal (isolate a device, run an antivirus scan, purge an email) and how the signals from each product end up in a single incident.

  4. Week 4: Microsoft Sentinel

    Connect data sources, create a scheduled analytics rule, build a simple workbook and write an automation rule that assigns incidents. This is the week that most rewards doing the labs instead of reading.

  5. Week 5: incident response and threat hunting

    Work through complete investigations end to end and practice hunting queries in Defender XDR advanced hunting and Sentinel. Learn how a hunting query becomes a detection rule.

  6. Week 6: review and practice assessment

    Take the free practice assessment on Microsoft Learn, list every topic where you hesitated, and go back to those modules. Try the exam sandbox too, so the exam interface holds no surprises on the day.

The KQL you should be comfortable with

You do not need to be a KQL expert, but you should read and write queries like this one without hesitation. It looks for PowerShell launched with an encoded command, a common way to hide what a script really does:

encoded-powershell.kql
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("-EncodedCommand", "-enc ")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc
| take 50

Notice that advanced hunting in Defender XDR uses the Timestamp column, while most tables in Sentinel use TimeGenerated. Small differences like this are exactly what the exam likes to test.

Exam day

The passing score is 700 on a scale of 1000. Questions include case studies, where you read a scenario about a fictional company and answer several questions about it. Read the scenario once quickly, then return to it for each question; the details you need are usually in the requirements section.

After you pass

SC-200 is an associate-level certification, which means it expires after one year. You can renew it for free with an online assessment on Microsoft Learn in the six months before it expires. More importantly, keep using what you learned: the analyst who writes KQL every day will be far ahead of the one who only passed the exam.

Terms in this article

SIEM
A platform that collects logs from across an organization, correlates them and raises alerts, giving the SOC one place to investigate.
XDR
A security platform that correlates detections from endpoints, identities, email, cloud apps and more into single incidents with a shared response console.
EDR
Security software on laptops and servers that records process, file and network activity, detects malicious behavior and lets analysts respond.
KQL
The read-only query language used by Microsoft Sentinel, Defender XDR advanced hunting, Azure Monitor and Azure Data Explorer.
Incident response
The organized process of detecting, analyzing, containing, eradicating and recovering from a security incident, then learning from it.
Threat hunting
The proactive search for attackers who are already inside the environment but have not triggered any alert, usually starting from a hypothesis.

Last reviewed on

Keep reading