WGU D485 Study guide for Exam SC-200: Microsoft Security Operations Analyst Latest Update with complete solution

Study guide for Exam SC-200: Microsoft Security Operations Analyst Purpose of this document This study guide should help you understand what to expect on the exam and includes a summary of the topics the exam might cover and links to additional resources. The information and materials in this document should help you focus your studies as you prepare for the exam. Useful links Description Review the skills measured as of February 7, 2023 This list represents the skills measured AFTER the date provided. Study this list if you plan to take the exam AFTER that date. Review the skills measured prior to February 7, 2023 Study this list of skills if you take your exam PRIOR to the date provided. Change log You can go directly to the change log if you want to see the changes that will be made on the date provided. How to earn the certification Some certifications only require passing one exam, while others require passing multiple exams. Certification renewal Microsoft associate, expert, and specialty certifications expire annually. You can renew by passing a free online assessment on Microsoft Learn. Your Microsoft Learn profile Connecting your certification profile to Learn allows you to schedule and renew exams and share and print certificates. Passing score A score of 700 or greater is required to pass. Exam sandbox You can explore the exam environment by visiting our exam sandbox. Request accommodations If you use assistive devices, require extra time, or need modification to any part of the exam experience, you can request an accommodation. 1 Exam SC-200: Microsoft Security Operations Analyst Useful links Description Take a practice test Are you ready to take the exam or do you need to study a bit more? Updates to the exam Our exams are updated periodically to reflect skills that are required to perform a role. We have included two versions of the Skills Measured objectives depending on when you are taking the exam. We always update the English language version of the exam first. Some exams are localized into other languages, and those are updated approximately eight weeks after the English version is updated. Other available languages are listed in the Schedule Exam section of the Exam Details webpage. If the exam isn't available in your preferred language, you can request an additional 30 minutes to complete the exam. Note The bullets that follow each of the skills measured are intended to illustrate how we are assessing that skill. Related topics may be covered in the exam. Note Most questions cover features that are general availability (GA). The exam may contain questions on Preview features if those features are commonly used. Skills measured as of February 7, 2023 Audience profile The Microsoft security operations analyst collaborates with organizational stakeholders to secure information technology systems for the organization. Their goal is to reduce organizational risk by rapidly remediating active attacks in the environment, advising on improvements to threat protection practices, and referring violations of organizational policies to appropriate stakeholders. Responsibilities include threat management, monitoring, and response by using a variety of security solutions across their environment. The role primarily investigates, responds to, and hunts for threats using Microsoft Sentinel, Microsoft Defender for Cloud, Microsoft 365 Defender, and third-party security products. Since the security operations analyst consumes the operational output of these tools, they are also a critical stakeholder in the configuration and deployment of these technologies. Candidates for this role should be familiar with attack vectors, cyberthreats, incident management, and Kusto Query Language (KQL). Candidates should also be familiar with Microsoft 365 and Azure services. • Mitigate threats using Microsoft 365 Defender (25–30%) • Mitigate threats using Microsoft Defender for Cloud (20–25%) • Mitigate threats using Microsoft Sentinel (50–55%) 2 Exam SC-200: Microsoft Security Operations Analyst Mitigate threats using Microsoft 365 Defender (25–30%) Mitigate threats to the productivity environment by using Microsoft 365 Defender • Investigate, respond, and remediate threats to Microsoft Teams, SharePoint, and OneDrive • Investigate, respond, and remediate threats to email by using Microsoft Defender for Office 365 • Investigate and respond to alerts generated from Data Loss Prevention policies • Investigate and respond to alerts generated from insider risk policies • Identify, investigate, and remediate security risks by using Microsoft Defender for Cloud Apps • Configure Microsoft Defender for Cloud Apps to generate alerts and reports to detect threats