OpenExamsFREE PRACTICE — ANY EXAM

Microsoft Certified: Security Operations Analyst Associate — Requirements & Free Practice

US · License preparation

100 free questions · Answer explanations · No signup required

Choose what to practice

Start with an exam below. Your examination requirements depend on your application pathway. View licensing requirements

Loading selected examination banks…

Licenses, application pathways and examination requirements

Each license and applicant pathway has its own requirements and exemptions. Choosing practice questions does not determine your eligibility.

Microsoft Certified: Security Operations Analyst Associate

Microsoft certification for security operations analysts who triage, investigate and respond to incidents, hunt threats, and engineer detections.

Licensing authority: Microsoft · Application information

Initial by examination
Exam SC-200: Microsoft Security Operations Analyst
Candidate Guidance
The audience profile recommends familiarity with Microsoft security, compliance and identity solutions, Microsoft 365, Azure, AI agents/Copilots, and Windows, Linux and mobile operating systems; these are stated as should, not additional examination prerequisites.
Delivery
Proctored; test-center or online options are subject to the provider's available options and online security requirements.
Identification
A Learn profile may be required; the legal name must match Legal ID. A personal MSA is strongly recommended, not mandatory by this evidence.
Language
This frozen scope is the English version effective October 21, 2026; localized versions can follow later and are not asserted to have identical adoption dates.
Scheduling
Rolling appointments through Pearson VUE; schedule no more than 90 days ahead; maximum two Microsoft Certification exams scheduled at a time, with another available after taking or canceling one.
Scope
Initial certification by passing the SC-200 examination; renewal is excluded.

Exam SC-200: Microsoft Security Operations Analyst

Provider
Pearson VUE
Format
Proctored examination; interactive components may be included.
Time limit
100 minutes
Passing score
700 or greater on the Microsoft technical-exam scale of 1 to 1,000; a scaled score is not a percentage.
Examination outline

The authority publishes percentage ranges for each content area. The practice percentages below use the midpoint of each range, normalized to 100%; they are not exact percentages published by the authority. Practice question counts may differ slightly because of rounding.

  • Manage a security operations environment — Official range: 40–45% (Practice allocation: 41.46%)
    • Configure automation for Microsoft Defender XDR and Microsoft Sentinel
    • Configure the Microsoft Sentinel SIEM and platform
    • Ingest data into the Microsoft Sentinel SIEM and platform
    • Configure detections
  • Respond to security incidents — Official range: 35–40% (Practice allocation: 36.59%)
    • Respond to alerts and incidents in Microsoft Defender XDR
    • Respond to alerts and incidents in Microsoft Defender for Endpoint
    • Investigate Microsoft 365 activities to identify threats
  • Perform threat hunting — Official range: 20–25% (Practice allocation: 21.95%)
    • Detect threats by using Microsoft Defender XDR
    • Detect threats by using the Microsoft Sentinel platform
Examination sources