SC-200 practice test — write the KQL and make the SOC calls the exam asks about
The SC-200 exam, Microsoft Security Operations Analyst, gives you scenario after scenario in Microsoft Defender XDR and Microsoft Sentinel and asks which connector, rule, role, response action or query fits. CrushCert drills exactly that: 300 original practice questions at the official skill-area weights, each explaining why the right answer is right and why every wrong answer is wrong. Alongside them: six hands-on KQL labs where you write real hunting and detection queries and the lab checks each clause, four drag-and-drop labs, flashcards with spaced repetition, and a 50-question, 100-minute timed mock exam.
7 days free · No card required · Built to pass you on the first try
Up to date: written to Microsoft's skills outline of October 21, 2026, using current names (Microsoft Defender portal, Defender XDR, Microsoft Sentinel in the Defender portal, Analytics and Data lake tiers, Azure Monitor Agent, custom detections).
How CrushCert gets you exam-ready
Write real KQL, get coached
Threat hunting is 20–25% of SC-200, and KQL turns up in detections and investigations too. Reading queries isn't the same as writing them, so six CrushCert labs have you type the query yourself, clause by clause, against real table and column names. The lab checks each clause and tells you exactly what's missing, such as a wrong time column, has where you needed contains, or count() where you needed dcount().
Adaptive practice
Quizzes prioritize questions you haven't seen and questions you missed, so your weak skill areas get more reps and every session moves your score.
Realistic mock exams
Timed tests of 50 questions on a 100-minute countdown, with a question navigator, mark-for-review, and a 70% pass line that mirrors the real 700 bar.
Every answer explained
All 300 questions are original, tagged to one of the three skill areas, and were reviewed against Microsoft Learn by a separate expert reviewer. Each explanation covers why the right answer is right and why every wrong choice is wrong.
What studying looks like
Real CrushCert SC-200 screens from the live app, not mockups.
What's on the SC-200 exam
Exam SC-200, Microsoft Security Operations Analyst, earns the Microsoft Certified: Security Operations Analyst Associate credential. You get 100 minutes and need a scaled score of 700 to pass. Microsoft doesn't publish the number of questions (third-party reports suggest about 40 to 60), and it doesn't publish one global price; in the US it's typically about $165. Microsoft says most questions cover generally available features, though the exam may include preview features if they're commonly used. The certification renews yearly with a free online renewal assessment on Microsoft Learn. Microsoft Sentinel now runs in the Microsoft Defender portal, and Microsoft says Sentinel is no longer supported in the Azure portal after March 31, 2027, so study the Defender portal experience. The three skill areas and their weights:
| Skill area | CrushCert questions | Exam weight |
|---|---|---|
| Manage a security operations environment | 124 | 40–45% |
| Respond to security incidents | 110 | 35–40% |
| Perform threat hunting | 66 | 20–25% |
These are the skills measured as of October 21, 2026; Microsoft's change log for that update lists one minor change, to ingesting data into Microsoft Sentinel, with the domain names and weights unchanged. CrushCert's 300 questions follow the official weights. The bank includes least-privilege Sentinel role scenarios, connector-and-table questions, alert tuning, automation rules versus playbooks, retention tier choices, device response actions and plenty of KQL. Topic coverage includes:
Train on every skill area above
Adaptive practice questions and hands-on labs mapped to these exact skill areas. 7 days free, no card required.
Start free trialThe 10 hands-on SC-200 labs
Six are KQL labs: you type the query an analyst or detection engineer would write, one clause at a time, and the lab checks each clause and coaches you on what's missing. The other four are drag-and-drop labs that drill the choices the exam keeps asking about.
Hunt, detect and investigate
Hunt Failed Sign-ins in Sentinel (SigninLogs, where a ResultType of "0" means success) · Find Encoded PowerShell on Endpoints (DeviceProcessEvents) · Who Clicked the Phishing Link? (join EmailEvents to UrlClickEvents) · Turn a Hunt into a Custom Detection (Timestamp, DeviceId and ReportId) · Write a Brute-Force Analytics Rule Query (bin(TimeGenerated, 5m)) · Hunt Lateral Movement over RDP (dcount() across devices).
Make the right call
Work the Incident in Order (triage, investigate, contain, remediate, resolve, improve) · Pick the Sentinel Data Connector (Windows Forwarded Events, CEF via AMA, Syslog via AMA, Azure Activity, TAXII) · Which Defender Raised It? (Endpoint, Office 365, Cloud Apps, Cloud, Entra ID Protection) · Choose the Right Data Tier (Data lake tier, XDR default retention, summary rule, KQL job).
SecurityEvent
| where TimeGenerated > ago(1h)
| where EventID == 4625
| summarize FailedLogons = count() by Account, bin(TimeGenerated, 5m)
| where FailedLogons > 20
// leave out the bin() and the lab tells you: group into 5-minute buckets with bin(TimeGenerated, 5m).
// each clause is checked · spacing and case don't matter
The KQL labs run in a simulated query console: nothing runs against a real workspace, and you don't need an Azure subscription to use them. For real hands-on practice, hunt in the Defender portal of a test tenant.
Free SC-200 practice questions: are you ready?
Ten questions across all three exam domains. Answer each one, see the explanation, and find out which topic to work on first. No account needed.
Free readiness check
Hide alert stops alert and incident creation for Defender for Endpoint alerts, and the hidden alerts are still kept in the AlertInfo and AlertEvidence tables for hunting. Resolve alert still creates the alert and incident, just already resolved. Set as behavior turns the activity into a behavior record instead of an alert, which is not what is asked. Classifying an alert as a false positive is a one-off verdict on an existing alert and does not stop new ones. Every CrushCert question includes an explanation like this.
The Data lake tier is the low-cost tier for data that is rarely queried, and it supports retention of up to 12 years. The Analytics tier is built for real-time detection and hunting, costs more and tops out at 2 years of retention, so it can neither hold 7 years nor meet the cost goal. The XDR default tier keeps Defender XDR hunting data for 30 days only. Keeping data in the Analytics tier for 2 years still falls short of the 7-year requirement.
Microsoft Sentinel Playbook Operator lets users list, view and manually run playbooks without editing them. Logic App Contributor lets users create and edit playbooks, which is more than needed. Microsoft Sentinel Contributor manages analytics rules, workbooks and other Sentinel resources. Microsoft Sentinel Automation Contributor exists for Sentinel's own service use with automation rules and is not meant for user accounts.
Windows Forwarded Events only needs the Azure Monitor Agent on the collector, so the source servers stay agent-free, and the data lands in WindowsEvent. Windows Security Events via AMA installs AMA on each source machine, which the policy forbids. Syslog via AMA and CEF via AMA collect from Linux forwarders and network devices, not from a Windows Event Collector.
ZAP for spam and high-confidence spam follows the anti-spam policy action, but only for unread messages, so a read spam message is left where it is. Quarantining a message whether or not it was read is how ZAP treats malware and high-confidence phishing. ZAP doesn't hard delete messages. The anti-spam policy action would apply only if the message were still unread.
Dismiss user risk sets the risk state to Dismissed and doesn't change the password, which fits a verified false positive. Confirm user compromised does the opposite and records the user as compromised. Requiring a password change alters the password, which you want to avoid. Blocking sign-in would stop the user working without clearing the risk.
Restrict app execution lets only Microsoft-signed files run, so the unknown executable is blocked while the device stays on the network. Isolating the device would cut network access, which the requirement rules out. An antivirus scan looks for known threats but does not stop other unsigned code from running. Collecting an investigation package gathers forensic data but contains nothing.
UrlClickEvents records Safe Links clicks from email, Teams and Office apps, and its IsClickedThrough column shows whether the user continued past the warning. EmailUrlInfo lists URLs found inside email messages, not clicks, and it doesn't cover Teams. EmailEvents describes message delivery and detected threats, not user clicks. CloudAppEvents records cloud app activity from Defender for Cloud Apps, not Safe Links click verdicts.
contains matches any substring, so it finds "mimi" inside "mimikatz". has matches only whole terms, and "mimikatz" is one term, so has "mimi" returns false. == requires the entire command line to equal "mimi". startswith only matches when the whole command line begins with that text.
With no kind specified, KQL uses innerunique, which removes duplicate keys from the left table before matching. kind=inner keeps every matching combination. leftsemi returns only left rows that have a match, without any right-side columns. A broadcast hint changes how the join runs, not which rows it returns, and Microsoft recommends the smaller table on the left anyway.
Why learners pick CrushCert
You practice the way the exam tests you. SC-200 is mostly scenarios — "your SOC uses Microsoft Sentinel in the Defender portal… what should you do?" — where one constraint decides the answer: least privilege, existing resources must be covered, events must land in SecurityEvent, the lowest cost for two years of logs, or no manual approval. CrushCert's questions are built the same way, every distractor is a real Microsoft security feature, role or table you could confuse, and every explanation tells you why the other choices are wrong.
Most question banks stop at multiple choice. We didn't find KQL labs in the SC-200 products from Tutorials Dojo, CertCrush or MeasureUp, which sell question banks. CrushCert adds six labs where you write the query yourself and get coached on each clause, because on the job, and in the hunting domain, you have to produce the KQL, not just recognize it.
It is a practice bank, not a course or a tenant. CrushCert is practice questions, KQL and drag-and-drop labs and mock exams, not a video course and not a live Defender or Sentinel environment. Pair it with Microsoft Learn's free self-paced SC-200 training and time in the Defender portal, then use CrushCert to find the skill areas you still miss. It suits SOC analysts, IT pros moving into security operations, Azure and Microsoft 365 administrators taking on security, and Security+ holders adding Microsoft's SecOps track.
You always know your readiness. A live readiness score blends your quiz accuracy, mock results, and lab performance, and points you to exactly what to study next.
A guided plan tells you what to study today. Guided Learning builds a short daily plan from your performance — a warm-up review, a lesson on your weakest topic, and flashcards, with spaced repetition so material comes back right before you'd forget it.
SC-200 pricing
$15/month
Microsoft Security Operations Analyst (SC-200) on its own: all 300 questions, the 10 labs, flashcards, mock exams, the readiness score and Guided Learning.
$24/month
All 23 exams across Cisco, CompTIA, AWS, ISC2 and Microsoft, SC-200 included — worth it if you're stacking certs.
7-day free trial · No card required · Cancel anytime · SC-200 is a Professional-tier exam, so the $19 Associate plan doesn't include it
Keep learning: SC-200 reading
Best SC-200 practice tests in 2026
Microsoft's free training and the paid question banks side by side — what you get, and who each one suits.
WORTH IT?Is the SC-200 worth it in 2026?
What the Security Operations Analyst Associate honestly does for you, who it pays off for, and why renewal costs nothing.
TIMELINEHow long to study for the SC-200?
Typical timelines by background, from analysts who live in Defender XDR to IT pros new to Microsoft security.
STUDY PLANSC-200 study plan
A schedule across the three skill areas, pairing Microsoft Learn and Defender portal time with practice questions, KQL labs and a timed mock.
SECURITY FOUNDATIONSCompTIA Security+ practice test
New to security? The vendor-neutral foundation many analysts take before a Microsoft SecOps exam.
AZURE ADMINAZ-104 Azure Administrator practice test
The infrastructure side of Azure: identity, storage, compute and networking, with six Azure CLI command labs.
Not sure which cert comes next? Take the two-minute Which certification should I take? quiz.
Ready to crush the SC-200?
300 original questions, six KQL labs plus four drag-and-drop labs, explanations on every answer, and a timed mock exam — start free for 7 days, no card required.
Start studying freeSC-200 FAQ
Is the SC-200 hard?
It is a role-based associate exam for security operations analysts, so expect scenarios rather than definitions: an alert, an incident or a hunting task, one constraint that decides the answer, and four real Microsoft security options to choose from. What trips people up is detail that looks similar: Windows Forwarded Events lands in WindowsEvent, not SecurityEvent; Fusion isn't available once Microsoft Sentinel is in the Defender portal; Hide alert versus Resolve alert; has versus contains in KQL; Timestamp versus TimeGenerated; and the innerunique default on a KQL join. You have 100 minutes and need a scaled score of 700 to pass.
How much KQL do I need for SC-200?
Enough to read and fix short queries. Threat hunting is 20 to 25% of the exam, and KQL also shows up in detections, data connectors and incident investigation. Know where, project, extend, summarize with count() and dcount(), bin(), top, join (including kind=inner), has versus contains, == versus =~, and which tables use Timestamp (Defender XDR) versus TimeGenerated (Microsoft Sentinel). CrushCert's six KQL labs drill exactly these.
How long does it take to study for the SC-200?
Our estimate, at roughly 6 to 8 hours a week: about 3 to 4 weeks if you already work in Defender XDR and Microsoft Sentinel every day, about 6 to 8 weeks if you are an IT or security professional new to Microsoft's security tools, and 12 weeks or more if you are new to security. Hands-on time in the Defender portal and some KQL practice every week help a lot.
How many questions are on the SC-200 exam?
Microsoft doesn't publish a question count for SC-200; third-party reports suggest about 40 to 60 questions. You get 100 minutes and need a scaled score of 700 to pass. CrushCert's mock exam is 50 questions on a 100-minute timer with a 70% pass line that mirrors the 700 bar.
Do the KQL labs use a real Microsoft Sentinel workspace?
No. The KQL labs run in a simulated query console: you type real KQL against real table and column names (SigninLogs, SecurityEvent, DeviceProcessEvents, DeviceLogonEvents, EmailEvents, UrlClickEvents), the lab checks each clause of your query and tells you what's missing, then shows sample results. Nothing runs against a real workspace and no Azure subscription or cost is involved. For real practice, hunt in the Defender portal of a test tenant.
Which version of the SC-200 should I study, and is the bank updated when Microsoft changes the outline?
Study the skills measured as of October 21, 2026. Microsoft's change log for that update lists one minor change, to ingesting data into the Microsoft Sentinel SIEM and platform; the domain names and weights stayed the same. Every CrushCert question is written to that version using current names: the Microsoft Defender portal, Defender XDR, Microsoft Sentinel in the Defender portal, the Analytics and Data lake tiers, the Azure Monitor Agent and custom detections. We will update the bank when Microsoft updates the outline.
Does the Security Operations Analyst certification expire?
Yes, it renews yearly. Microsoft Certified: Security Operations Analyst Associate is renewed with a free online assessment on Microsoft Learn, so you don't pay for the exam again. Microsoft doesn't publish one global price; in the US it's typically about $165.
Is CrushCert enough on its own to pass the SC-200?
Use it alongside Microsoft Learn, not instead of it. CrushCert is practice questions, ten labs and mock exams, not a video course and not a live Defender or Sentinel tenant. Work through Microsoft Learn's free self-paced SC-200 training, spend time in the Defender portal of a test tenant, then use CrushCert to drill the skill areas you still miss.