SC-200 Training: Security Operations Analyst
Preparation for SC-200: running security operations in Microsoft Sentinel and Defender XDR, responding to incidents across identity, endpoint, email and cloud, and threat hunting with KQL.
- ExamSC-200
- LevelAssociate
- FormatLive online, tutor-led
- TrainerMicrosoft Certified Trainer
- Exam feePaid to Microsoft
Learn, practise, prove
- LearnLive online classes with a Microsoft Certified Trainer.
- PractiseHands-on, in your own Microsoft 365 or Azure trial tenant, with setup guidance.
- ProveTaught to Microsoft’s skills outline, domain by domain. You book the exam when you are ready.
What the exam covers
Weightings are Microsoft’s. Microsoft updates the skills outline on 21 October 2026 – minor changes to the detail; the areas and weightings below stay the same.
- Manage a security operations environment40–45%
- Respond to security incidents35–40%
- Perform threat hunting20–25%
About the exam
- You need a score of 700 or more to pass.
- Microsoft offers a free practice assessment and an exam sandbox for most exams – use both before you book.
- The exam fee is not included. It is paid to Microsoft when you book.
- Associate and Expert certifications are valid for a year. You renew them free of charge with an online assessment on Microsoft Learn.
Where it leads
SC-200 is one of the prerequisite routes to SC-100 (Cybersecurity Architect Expert). If you want the day-to-day SOC skills around the exam – alert queues, case notes, a shift simulation – see the Blue Team Analyst programme.
What happens after you buy
- You get an order confirmation by emailStraight away.
- We agree your start date and scheduleAt times that fit around your job.
- Your class links and materialsWe email you how to join, with your materials, before your first class.
- You book the exam when you are readyWe will tell you honestly when that is.
MyCyberWay is an independent training provider. Microsoft certifications are awarded by Microsoft when you pass its exam; the exam is booked and paid for separately, and its fee is set by Microsoft for your country. We do not guarantee a pass – but we will tell you honestly when we think you are ready.
Free learning resources
A few free, official links to start on now. Links to other sites open in a new tab.
From Microsoft
- SC-200 on Microsoft Learn (opens in a new tab)learn.microsoft.comThe current skills outline, the exam price for your country and how to book.
- SC-200 study guide (opens in a new tab)learn.microsoft.comEvery skill measured, with the latest changes to the outline.
- SC-200 practice assessment (opens in a new tab)learn.microsoft.comFree questions in the exam's style, with explanations.
When you enrol
The full library for this course, section by section and chosen by your tutors, is waiting in the learning portal, alongside your classes.
Questions people ask first
Anything else, ask us. A person replies.
Are the exam fees included?
No. You pay Microsoft directly when you book the exam, at its price for your country. Our course fee covers the training only.
Which exam should I take first?
Usually SC-900 if security is new to you, or AZ-900 if Azure is. After that it depends on the role you want – certification guidance maps eleven roles to the exams in order.
Do you guarantee a pass?
No, and nobody honest can. We teach to Microsoft’s outline, give you practice in a real tenant, and tell you honestly when we think you’re ready to book.
How do I book the exam?
Through Microsoft Learn, when you’re ready. You can sit most Microsoft exams online or at a test centre.
I hold AZ-500. Do I need SC-500?
AZ-500 retired on 31 August 2026. Your certification stays on your transcript, but it can no longer be renewed and there is no transition exam. To hold the current security engineer certification you pass SC-500.
