Description
The certification for SOC work on Microsoft’s stack. You learn to run the security operations environment in Microsoft Sentinel and Defender XDR, respond to incidents across identity, endpoint, email and cloud, and hunt for threats with KQL – including Security Copilot and the agentic AI features now in the exam.
What the exam covers
Weightings are Microsoft’s. Microsoft updates the skills outline on 21 October 2026 – minor changes to the detail; the areas and weightings below stay the same.
-
Manage a security operations environment 40–45% of the exam
Automation in Defender XDR and Sentinel (alert tuning, automated investigation, attack disruption, automation rules and playbooks), Sentinel roles, retention tiers and workbooks, data connectors and ingestion, and detections – analytics rules, custom detections and MITRE ATT&CK coverage.
-
Respond to security incidents 35–40% of the exam
Investigating and remediating incidents from Defender for Office 365, Endpoint, Identity, Cloud Apps and Cloud, Entra ID, Purview and Sentinel; multi-stage attacks and lateral movement; Security Copilot; device timelines and live response; and Purview Audit, eDiscovery and Graph activity logs.
-
Perform threat hunting 20–25% of the exam
KQL and Advanced Hunting, threat analytics, hunting graphs and blast radius, Sentinel hunting queries, data lake KQL jobs, summary rules and notebooks.
How the training runs
- Live, tutor-led online classes in UK hours
- Taught by a Microsoft Certified Trainer
- Hands-on practice in your own Microsoft 365 or Azure trial tenant, with setup guidance
- Mapped to Microsoft’s published skills outline, domain by domain
About the exam
- You need a score of 700 or more to pass.
- Microsoft offers a free practice assessment and an exam sandbox for most exams – use both before you book.
- The exam fee is not included. It is paid to Microsoft when you book.
- Associate and Expert certifications are valid for a year. You renew them free of charge with an online assessment on Microsoft Learn.
Where it leads
SC-200 is one of the prerequisite routes to SC-100 (Cybersecurity Architect Expert). If you want the day-to-day SOC skills around the exam – alert queues, case notes, a shift simulation – see the Blue Team Analyst programme.
What happens after you buy
- You get an order confirmation by email Straight away.
- We agree your start date and schedule In UK hours, around your job.
- We set up your learning account We email you how to sign in before your first class. Our new learning portal opens soon.
- You book the exam when you are ready We will tell you honestly when that is.
MyCyberWay is an independent training provider. Microsoft certifications are awarded by Microsoft when you pass its exam; the exam is booked and paid for separately, and its fee is set by Microsoft for your country. We do not guarantee a pass – but we will tell you honestly when we think you are ready.
