SC-200 study plan

Week 1chapters 1–4 · about 9 hours Done

• Read these chapters:
  • 1. Microsoft Defender XDR: portal, alerts and incidents
  • 2. Configuring Microsoft Defender for Endpoint
  • 3. Automation: Microsoft Sentinel automation rules and playbooks
  • 4. Responding on devices with Defender for Endpoint
• After each chapter, cover its key takeaways and explain each one out loud. Re-read any you can’t.
• Free study notes for this week: Attack surface reduction rules: requirements, modes, deployment and exclusions, Automated investigation and response in Defender for Endpoint: automation levels explained, Defender for Endpoint live response: settings, permissions, commands and limits.
• Look up any unfamiliar term in the SC-200 glossary.

Exam skill areas this week: Manage a security operations environment · 40–45%Respond to security incidents · 35–40%

Week 2chapters 5–8 · about 9 hours Done

• Read these chapters:
  • 5. Microsoft Sentinel: workspace, roles, retention, workbooks and optimisation
  • 6. Ingesting data into Microsoft Sentinel
  • 7. Detections: custom detection rules and Sentinel analytics
  • 8. Email and data threats: Defender for Office 365 and Microsoft Purview alerts
• After each chapter, cover its key takeaways and explain each one out loud. Re-read any you can’t.
• Free study notes for this week: Syslog via AMA vs CEF via AMA: tables, forwarders and duplicates, Custom detections vs Microsoft Sentinel analytics rules: choosing a detection type, Defender for Office 365 Plan 1 vs Plan 2: Safe Attachments, Safe Links, anti-phishing and ZAP.
• Look up any unfamiliar term in the SC-200 glossary.

Exam skill areas this week: Manage a security operations environment · 40–45%Respond to security incidents · 35–40%

Week 3chapters 9–12 · about 10 hours Done

• Read these chapters:
  • 9. Cloud, app and identity threats
  • 10. Investigating incidents across Microsoft 365 and with Security Copilot
  • 11. Threat hunting with KQL and Advanced hunting
  • 12. Hunting on the Microsoft Sentinel platform
• After each chapter, cover its key takeaways and explain each one out loud. Re-read any you can’t.
• Free study notes for this week: Microsoft Entra ID Protection: user risk vs sign-in risk, KQL jobs vs summary rules vs search jobs in Microsoft Sentinel.
• Look up any unfamiliar term in the SC-200 glossary.

Exam skill areas this week: Manage a security operations environment · 40–45%Respond to security incidents · 35–40%Perform threat hunting · 20–25%

Week 4review Done

• Go back through every chapter’s key takeaways. Anything you can’t explain without looking, re-read that section.
• Re-read the common-trap callouts: they mark the answers that look right but aren’t.
• Check the exam coverage map against Microsoft’s own outline, in case it has changed since the book was checked.
• Take Microsoft’s free practice assessment, if your exam has one, from the official SC-200 study guide page. Revisit the chapters behind any weak area.
• Try the exam sandbox to get used to the exam’s screens and question formats.
• Get the free exam-day checklist and work through it a few days before your exam.

Week 1chapters 1–2 · about 4 hours Done

• Read these chapters:
  • 1. Microsoft Defender XDR: portal, alerts and incidents
  • 2. Configuring Microsoft Defender for Endpoint
• After each chapter, cover its key takeaways and explain each one out loud. Re-read any you can’t.
• Free study notes for this week: Attack surface reduction rules: requirements, modes, deployment and exclusions, Automated investigation and response in Defender for Endpoint: automation levels explained.
• Look up any unfamiliar term in the SC-200 glossary.

Exam skill areas this week: Manage a security operations environment · 40–45%Respond to security incidents · 35–40%

Week 2chapter 3 · about 2 hours Done

• Read chapter:
  • 3. Automation: Microsoft Sentinel automation rules and playbooks
• After each chapter, cover its key takeaways and explain each one out loud. Re-read any you can’t.
• Look up any unfamiliar term in the SC-200 glossary.

Exam skill areas this week: Manage a security operations environment · 40–45%

Week 3chapters 4–5 · about 4 hours Done

• Read these chapters:
  • 4. Responding on devices with Defender for Endpoint
  • 5. Microsoft Sentinel: workspace, roles, retention, workbooks and optimisation
• After each chapter, cover its key takeaways and explain each one out loud. Re-read any you can’t.
• Free study notes for this week: Defender for Endpoint live response: settings, permissions, commands and limits.
• Look up any unfamiliar term in the SC-200 glossary.

Exam skill areas this week: Manage a security operations environment · 40–45%Respond to security incidents · 35–40%

Week 4chapters 6–7 · about 5 hours Done

• Read these chapters:
  • 6. Ingesting data into Microsoft Sentinel
  • 7. Detections: custom detection rules and Sentinel analytics
• After each chapter, cover its key takeaways and explain each one out loud. Re-read any you can’t.
• Free study notes for this week: Syslog via AMA vs CEF via AMA: tables, forwarders and duplicates, Custom detections vs Microsoft Sentinel analytics rules: choosing a detection type.
• Look up any unfamiliar term in the SC-200 glossary.

Exam skill areas this week: Manage a security operations environment · 40–45%

Week 5chapters 8–9 · about 5 hours Done

• Read these chapters:
  • 8. Email and data threats: Defender for Office 365 and Microsoft Purview alerts
  • 9. Cloud, app and identity threats
• After each chapter, cover its key takeaways and explain each one out loud. Re-read any you can’t.
• Free study notes for this week: Defender for Office 365 Plan 1 vs Plan 2: Safe Attachments, Safe Links, anti-phishing and ZAP, Microsoft Entra ID Protection: user risk vs sign-in risk.
• Look up any unfamiliar term in the SC-200 glossary.

Exam skill areas this week: Manage a security operations environment · 40–45%Respond to security incidents · 35–40%

Week 6chapters 10–11 · about 5 hours Done

• Read these chapters:
  • 10. Investigating incidents across Microsoft 365 and with Security Copilot
  • 11. Threat hunting with KQL and Advanced hunting
• After each chapter, cover its key takeaways and explain each one out loud. Re-read any you can’t.
• Look up any unfamiliar term in the SC-200 glossary.

Exam skill areas this week: Manage a security operations environment · 40–45%Respond to security incidents · 35–40%Perform threat hunting · 20–25%

Week 7chapter 12 · about 2 hours Done

• Read chapter:
  • 12. Hunting on the Microsoft Sentinel platform
• After each chapter, cover its key takeaways and explain each one out loud. Re-read any you can’t.
• Free study notes for this week: KQL jobs vs summary rules vs search jobs in Microsoft Sentinel.
• Look up any unfamiliar term in the SC-200 glossary.

Exam skill areas this week: Perform threat hunting · 20–25%

Week 8review Done

• Go back through every chapter’s key takeaways. Anything you can’t explain without looking, re-read that section.
• Re-read the common-trap callouts: they mark the answers that look right but aren’t.
• Check the exam coverage map against Microsoft’s own outline, in case it has changed since the book was checked.
• Take Microsoft’s free practice assessment, if your exam has one, from the official SC-200 study guide page. Revisit the chapters behind any weak area.
• Try the exam sandbox to get used to the exam’s screens and question formats.
• Get the free exam-day checklist and work through it a few days before your exam.