SC-200 just received the largest restructure since it was introduced just over three years ago. Has the restructure changed what you need to know for the exam, or is it mostly an adjustment to focus on role skills as the grouping for objective domains, rather than the objective domains being grouped by technology? Let’s start by taking a look at the new sections and weightings.

  • Manage a security operations environment (25–30%)
  • Configure protections and detections (15–20%)
  • Manage incident response (35–40%)
  • Perform threat hunting (15–20%)

If we compare it to the previous version, you can immediately see that it is very different indeed.

  • Mitigate threats by using Microsoft 365 Defender (25–30%)
  • Mitigate threats by using Defender for Cloud (15–20%)
  • Mitigate threats by using Microsoft Sentinel (50–55%)

Taking a look at the new additions that don’t completely overlap with, previous objectives, we end up with the following list. I’m not suggesting that these are the only changes, instead they are the things that stood out to me when I was updating this guide.

  • Configure automatic attack disruption in Microsoft Defender XDR
  • Configure bidirectional synchronization between Microsoft Sentinel and Microsoft Defender XDR
  • Configure policies for Microsoft Defender for Office
  • Configure deception rules in Microsoft Defender XDR
  • Investigate and remediate security risks identified by Microsoft Defender for Cloud Apps
  • Investigate and remediate ransomware and business email compromise incidents identified by automatic attack disruption
  • Investigate timeline of compromised devices
  • Perform actions on the device, including live response and collecting investigation packages
  • Perform evidence and entity investigation
  • Perform threat hunting by using Microsoft Graph activity logs
  • Run playbooks on On-premises resources

All up, if we look at everything else the exam still includes, this exam description update is definitely a major restructure, but not necessarily a major change to the skills the exam expects you to have.

This is one my favorite exams to recommend for someone who wants to get into Microsoft cybersecurity technologies and exams, due the Defender and Sentinel skills you need to pass the exam. If you’ve already passed MS-500 (now retired) and AZ-500, this is an excellent choice as your next exam, because there will be some overlap in the technologies, but expect this exam to go deeper into understanding the Defender family of technologies, and it also goes deeper into Sentinel than you will have seen on previous exams. You will definitely need to spend time with Kusto and Log Analytics, not just for the Microsoft Sentinel questions in the exam, but Microsoft 365 Defender and Microsoft Defender for Cloud as well.

Manage a security operations environment (25–30%)

Configure settings in Microsoft Defender XDR

Manage assets and environments

Design and configure a Microsoft Sentinel workspace

Ingest data sources in Microsoft Sentinel

Configure protections and detections (15–20%)

Configure protections in Microsoft Defender security technologies

Configure detection in Microsoft Defender XDR

Configure detections in Microsoft Sentinel

Manage incident response (35–40%)

Respond to alerts and incidents in Microsoft Defender XDR

Respond to alerts and incidents identified by Microsoft Defender for Endpoint

Enrich investigations by using other Microsoft tools

Manage incidents in Microsoft Sentinel

Configure security orchestration, automation, and response (SOAR) in Microsoft Sentinel

Perform threat hunting (15–20%)

Hunt for threats by using KQL

Hunt for threats by using Microsoft Sentinel

Analyze and interpret data by using workbooks