This sc 200 study plan splits your preparation time to match Microsoft's published domain weights: managing a security operations environment (42%), responding to security incidents (36%), and performing threat hunting (22%). Pick the 4-, 8-, or 12-week version below depending on how much time you have before your exam date, and use scored mocks to confirm progress rather than guessing at readiness.
There is no single correct pace for preparing for Exam SC-200. What matters more than the calendar length is matching your study time to how Microsoft weights the three domains, so this sc 200 study plan uses the same 42/36/22 split across every version below, just compressed or stretched to fit the weeks you have.
How to use this plan
Each week below names the domain focus and a short set of activities. Spend roughly proportional time on each domain across the whole plan: managing a security operations environment gets the most weeks, responding to security incidents the second most, and performing threat hunting the fewest, but never zero. Revisit the exam objectives page as you go and check off individual objective statements as you become comfortable with each one.
4-week plan
- Weeks 1-2: Manage a security operations environment. Work through Defender XDR and Defender for Endpoint automation, alert and email notification configuration, device groups, and Microsoft Sentinel roles, automation rules, playbooks, and workbooks.
- Week 3: Respond to security incidents. Practice investigating and remediating alerts across Defender for Office 365, Purview, Defender for Cloud, Defender for Cloud Apps, Entra ID, and Defender for Identity, plus device timeline investigation and case management.
- Week 4: Perform threat hunting and full review. Practice KQL syntax, Advanced Hunting queries, hunting graphs, and Sentinel-platform hunting features, then sit a full-length timed mock and review every missed question by domain.
8-week plan
- Weeks 1-3: Manage a security operations environment. Go deeper into each automation and configuration objective, including attack surface reduction rules, custom data collection, and Sentinel data retention across Analytics, Data lake, and XDR tiers.
- Weeks 4-6: Respond to security incidents. Work scenario-based investigation practice across every source system listed in the objectives, including agentic AI and Security Copilot-assisted investigation, and complex multi-stage, multi-domain attacks.
- Week 7: Perform threat hunting. Build comfort with KQL tables, Advanced Hunting query construction, Sentinel Graph entity relationships, Data lake KQL jobs, and Summary rule tables.
- Week 8: Full review and mocks. Sit at least two full-length timed mocks, spaced a few days apart, and use the gap between them to close whichever domain scored lowest on the first attempt.
12-week plan
- Weeks 1-5: Manage a security operations environment. Treat this as the anchor domain: build hands-on time in a trial or lab tenant configuring Defender XDR automation and Microsoft Sentinel end to end, not just reading about each setting.
- Weeks 6-9: Respond to security incidents. Rotate through each source system's investigation workflow weekly, then spend a final week combining them into realistic multi-source incident scenarios.
- Weeks 10-11: Perform threat hunting. Spend real time writing and adjusting KQL queries rather than only reading example syntax, and practice building hunting graphs and reading Sentinel Graph relationships.
- Week 12: Full review and mocks. Sit multiple full-length timed mocks across the week, reviewing the explanation for every missed question, and revisit the exam format & scoring page so nothing about exam day itself is a surprise.
Adjusting the plan to your background
If you already work daily with Microsoft Sentinel or Defender XDR, you can likely compress the first domain's weeks and add that time to threat hunting instead, since KQL fluency tends to take longer to build than portal familiarity. Check prerequisites if you are unsure whether your current background is close enough to the exam's assumed starting point before you commit to any of the schedules above.
Whichever plan you follow, pair it with sample questions early to see how the objectives translate into scenario-based items, and finish with a full practice test close to your booked date.
Exam facts on this page come from Microsoft’s own pages (official exam page). Prices, versions and policies change — confirm there before you book.