SC-200 Security Operations Foundations

Distinguish the roles of SIEM, XDR, endpoint detection and response, and cloud workload protection in a security operations center.

Map Microsoft Sentinel, Microsoft Defender XDR, Microsoft Defender for Endpoint, Microsoft Entra ID, Microsoft Purview, and Defender for Cloud products to their security functions.

Distinguish alerts, incidents, evidence, entities, actions, and remediations in Microsoft security workflows.

Relate Microsoft 365 tenants, Azure subscriptions, Log Analytics workspaces, and data connectors in a unified security operations architecture.

Trace a security event from data ingestion through detection, incident creation, investigation, and response.

Prioritize study effort using the SC-200 skill-area weights effective July 28, 2026.