Duration : 4 Days
7654 participants
Looking for Corporate TrainingDedicated learner assistance ensures seamless training, from onboarding to post-course guidance.
Microsoft Security Operations Analyst (SC-200T00) Certification Training
The 4-day (32-hour), instructor-led SC200T00 training enables you to protect IT systems with Microsoft Sentinel, Microsoft Defender for Endpoint, and Microsoft 365 Defender. The course delivers a comprehensive knowledge of identifying and addressing security threats using advanced strategies.
SC-200T00 Certification Training
Choose from instructor-led online or corporate training options for convenience and accessibility.
Benefit from intermediate-level training tailored for professionals in threat management and security operations.
Engage in live, instructor-led sessions with scenario-based discussions and real-time threat analysis demonstrations.
Course Overview
The Microsoft Security Operations Analyst (SC-200T00) Certification Training is a comprehensive training that prepares participants to identify, analyse, and mitigate security threats. This course covers understanding how to use Microsoft’s advanced security tools, such as Microsoft Sentinel, Microsoft Defender for Endpoint, Microsoft 365 Defender, and Microsoft Defender for Cloud.
The participants will be exposed to the Kusto Query Language (KQL), allowing them to build and analyse queries for threat identification and prevention. The course is practical, focusing on threat hunting, incident handling process, and setup of automated actions. With Microsoft tools, learners will discover data loss prevention, insider risk management, and identity protection to improve organisations' security. The training also covers cloud workload protection, working with non-Azure resources, and managing security with Microsoft Defender for Cloud.
The course combines theoretical knowledge with lab exercises and case studies to help you implement concepts in real-world threat scenarios. At the end of the programme, you will be ready to take the SC-200 certification exam and demonstrate your capabilities in managing advanced security landscapes in organisations.
Loading...
Course Objectives
By the end of the course, participants will be able to:
- Analyse Microsoft 365 Defender to assess security breaches and threats to determine weaknesses.
- Implement an advanced attack surface reduction plan with Microsoft Defender for Endpoint.
- Investigate Microsoft Sentinel and advanced KQL queries to analyse incidents, alerts, and security breaches.
- Develop effective automated incident response with the help of Microsoft Sentinel playbooks for faster response.
- Configure and manage cloud workload protections using Microsoft Defender for Cloud and Azure services.
- Evaluate DLP alerts and insider threats and learn how to use Microsoft Purview to stay compliant.
- Apply protection measures for protecting the organisational access through Azure AD Identity Protection.
- Construct complex KQL statements in order to query logs and get usefull information from Microsoft Sentinel.
- Design guidelines on threat hunting and security monitoring for design analytics and policies.
- Optimise methods of handling vulnerabilities through Microsoft Defender for Endpoint to fix the systems’ flaws.
- Integrate non-Azure resources and third-party tools to Defender for a complete security solution.
- Monitor and control incident life cycles to optimise the handling of security operations’ resolution procedures.
Audience
This course targets:
- Security Professionals working with organisational stakeholders to secure IT systems.
- IT System Administrators responsible for managing and securing organisational information systems.
- Security Operations Analysts focusing on threat detection, monitoring, and response.
- Threat Management Specialists addressing security challenges and remediating active threats.
- Incident Response Teams investigating and managing security incidents effectively.
- Microsoft 365 Defender Users leveraging Microsoft tools for enhanced threat protection.
- Azure Defender Users securing cloud environments with advanced Microsoft solutions.
- Cybersecurity Professionals utilising third-party security tools for comprehensive threat management.
- Cloud Security Administrators configuring and deploying cloud workload protections.
- Learners and Professionals aspiring to specialise in Microsoft Sentinel, Defender XDR, and Defender for Cloud.
Eligibility Criteria
Though there are no strict requirements, it is suggested to have:
- Familiarity with Azure virtual machines and their functionality.
- A foundational understanding of scripting concepts and Microsoft 365.
- Basic knowledge of Microsoft security, identity products, and compliance standards.
- Intermediate understanding of the Windows 10 operating system.
- Proficiency in Azure services, including Azure storage and Azure SQL Database.
- Experience with investigating and responding to security threats (recommended).
- Background in IT security operations or related fields (preferred but not mandatory).
- Please contact us for more details about the eligibility conditions.
Course Outline
Module 1: Introduction to Microsoft 365 Threat Protection
- Understand Microsoft 365 Defender solution by domain
- Understand Microsoft 365 Defender's role in a Modern SOC
Module 2: Mitigate incidents using Microsoft 365 Defender
- Manage incidents in Microsoft 365 Defender
- Investigate incidents in Microsoft 365 Defender
- Conduct advanced hunting in Microsoft 365 Defender
Module 3: Protect your identities with Azure AD Identity Protection
- Describe the features of Azure Active Directory Identity Protection
- Describe the investigation and remediation features of Azure Active Directory Identity Protection
Module 4: Remediate risks with Microsoft Defender for Office 365
- Define the capabilities of Microsoft Defender for Office 365
- Understand how to simulate attacks within your network
- Explain how Microsoft Defender for Office 365 can remediate risks in your environment
Module 5: Safeguard your environment with Microsoft Defender for Identity
- Define the capabilities of Microsoft Defender for Identity
- Understand how to configure Microsoft Defender for Identity sensors
- Explain how Microsoft Defender for Identity can remediate risks in your environment
Module 6: Secure your cloud apps and services with Microsoft Defender for Cloud Apps
- Define the Defender for Cloud Apps framework
- Explain how Cloud Discovery helps you see what's going on in your organization.
- Understand how to use Conditional Access App Control policies to control access to the apps in your organization.
Module 7: Respond to data loss prevention alerts using Microsoft 365
- Describe data loss prevention (DLP) components in Microsoft 365
- Investigate DLP alerts in the Microsoft Purview compliance portal
- Investigate DLP alerts in Microsoft Defender for Cloud Apps
Module 8: Manage insider risk in Microsoft Purview
- Explain how Microsoft Purview Insider Risk Management can help prevent, detect, and contain internal risks in an organization.
- Describe the types of built-in, pre-defined policy templates
- List the prerequisites that need to be met before creating insider risk policies
- Explain the types of actions you can take on an insider risk management case
Module 9: Protect against threats with Microsoft Defender for Endpoint
- Define the capabilities of Microsoft Defender for Endpoint
- Understand how to hunt threats within your network
- Explain how Microsoft Defender for Endpoint can remediate risks in your environment
Module 10: Deploy the Microsoft Defender for the Endpoint environment
- Create a Microsoft Defender for the Endpoint environment
- Onboard devices are to be monitored by Microsoft Defender for EndpointConfigure Microsoft Defender for Endpoint environment settings
Module 11: Implement Windows security enhancements with Microsoft Defender for Endpoint
- Explain Attack Surface Reduction in Windows
- Enable Attack Surface Reduction rules on Windows 10 devices
- Configure Attack Surface Reduction rules on Windows 10 devices
Module 12: Perform device investigations in Microsoft Defender for Endpoint
- Use the device page in Microsoft Defender for Endpoint
- Describe device forensics information collected by Microsoft Defender for Endpoint
- Describe behavioural blocking by Microsoft Defender for Endpoint
Module 13: Perform actions on a device using Microsoft Defender for Endpoint
- Perform actions on a device using Microsoft Defender for Endpoint
- Conduct forensics data collection using Microsoft Defender for Endpoint
- Access devices remotely using Microsoft Defender for Endpoint
Module 14: Perform evidence and entities investigations using Microsoft Defender for Endpoint
- Investigate files in Microsoft Defender for Endpoint
- Investigate domains and IP addresses in Microsoft Defender for Endpoint
- Investigate user accounts in Microsoft Defender for Endpoint
Module 15: Configure and manage automation using Microsoft Defender for Endpoint
- Configure advanced features of Microsoft Defender for Endpoint
- Manage automation settings in Microsoft Defender for Endpoint
Module 16: Configure for alerts and detections in Microsoft Defender for Endpoint
- Configure alert settings in Microsoft Defender for Endpoint
- Manage indicators in Microsoft Defender for Endpoint
Module 17: Utilize Vulnerability Management in Microsoft Defender for Endpoint
- Describe Vulnerability Management in Microsoft Defender for Endpoint
- Identify vulnerabilities on your devices with Microsoft Defender for Endpoint
- Track emerging threats in Microsoft Defender for Endpoint
Module 18: Plan for cloud workload protections using Microsoft Defender for Cloud
- Describe Microsoft Defender for Cloud features
- Microsoft Defender for Cloud workload protections
- Enable Microsoft Defender for Cloud
- Labs: Microsoft Defender for Cloud interactive guide
Module 19: Connect Azure assets to Microsoft Defender for Cloud
- Explore Azure assets
- Configure auto-provisioning in Microsoft Defender for Cloud
- Describe manual provisioning in Microsoft Defender for Cloud
Module 20: Connect non-Azure resources to Microsoft Defender for Cloud
- Connect non-Azure machines to Microsoft Defender for Cloud
- Connect AWS accounts to Microsoft Defender for Cloud
- Connect GCP accounts to Microsoft Defender for Cloud
Module 21: Manage your cloud security posture management.
- Describe Microsoft Defender for Cloud features.
- Explain the Microsoft Defender for Cloud security posture management protections for your resources.
Module 22: Explain cloud workload protections in Microsoft Defender for Cloud
- Explain which workloads are protected by Microsoft Defender for Cloud
- Describe the benefits of the protections offered by Microsoft Defender for Cloud
- Explain how Microsoft Defender for Cloud protection function
Module 23: Remediate security alerts using Microsoft Defender for Cloud
- Describe alerts in Microsoft Defender for Cloud
- Remediate alerts in Microsoft Defender for Cloud
- Automate responses in Microsoft Defender for Cloud
Module 24: Construct KQL statements for Microsoft Sentinel
- Construct KQL statements
- Search log files for security events using KQL
- Filter searches based on event time, severity, domain, and other relevant data using KQL
Module 25: Analyze query results using KQL
- Summarize data using KQL statements
- Render visualizations using KQL statements
Module 26: Build multi-table statements using KQL
- Create queries using unions to view results across multiple tables using KQL.
- Merge two tables with the join operator using KQL
Module 27: Work with data in Microsoft Sentinel using Kusto Query Language
- Extract data from unstructured string fields using KQL
- Extract data from structured string data using KQL
- Create Functions using KQL
Module 28: Introduction to Microsoft Sentinel
- Identify the various components and functionality of Microsoft Sentinel
- Identify use cases where Microsoft Sentinel would be a good solution
Module 29: Create and manage Microsoft Sentinel workspaces
- Describe Microsoft Sentinel workspace architecture
- Install Microsoft Sentinel workspace
- Manage a Microsoft Sentinel workspace
Module 30: Query logs in Microsoft Sentinel
- Use the Logs page to view data tables in Microsoft Sentinel
- Query the most used tables using Microsoft Sentinel
Module 31: Use watchlists in Microsoft Sentinel
- Create a watchlist in Microsoft Sentinel
- Use KQL to access the watchlist in Microsoft Sentinel
Module 32: Utilize threat intelligence in Microsoft Sentinel
- Manage threat indicators in Microsoft Sentinel
- Use KQL to access threat indicators in Microsoft Sentinel
Module 33: Connect data to Microsoft Sentinel using data connectors
- Explain the use of data connectors in Microsoft Sentinel
- Describe the Microsoft Sentinel data connector providers
- Explain the Common Event Format and Syslog connector differences in Microsoft Sentinel
Module 34: Connect Microsoft services to Microsoft Sentinel
- Connect Microsoft service connectors
- Explain how connectors auto-create incidents in Microsoft Sentinel
Module 35: Connect Microsoft 365 Defender to Microsoft Sentinel
- Activate the Microsoft 365 Defender connector in Microsoft Sentinel
- Activate the Microsoft Defender for Cloud connector in Microsoft Sentinel
- Activate the Microsoft Defender for IoT connector in Microsoft Sentinel
Module 36: Connect Windows hosts to Microsoft Sentinel
- Connect Azure Windows Virtual Machines to Microsoft Sentinel
- Connect non-Azure Windows hosts to Microsoft Sentinel
- Configure Log Analytics agent to collect Sysmon events
Module 37: Connect Common Event Format logs to Microsoft Sentinel
- Explain the Common Event Format connector deployment options in Microsoft Sentinel
- Run the deployment script for the Common Event Format connector
Module 38: Connect syslog data sources to Microsoft Sentinel
- Describe the Syslog connector deployment options in Microsoft Sentinel
- Run the connector deployment script to send data to Microsoft Sentinel
- Configure the Log Analytics agent integration for Microsoft Sentinel
- Create a parse using KQL in Microsoft Sentinel
Module 39: Connect threat indicators to Microsoft Sentinel
- Configure the TAXII connector in Microsoft Sentinel
- Configure the Threat Intelligence Platform connector in Microsoft Sentinel
Module 40: Threat detection with Microsoft Sentinel analytics
- Explain the importance of Microsoft Sentinel Analytics
- Explain different types of analytics rules
- Create rules from templates
- Create new analytics rules and queries using the analytics rule wizard
- Manage rules with modifications
Module 41: Automation in Microsoft Sentinel
- Explain automation options in Microsoft Sentinel
- Create automation rules in Microsoft Sentinel.
Module 42: Threat response with Microsoft Sentinel Playbooks
- Explain Microsoft Sentinel SOAR capabilities
- Explore the Microsoft Sentinel Logic Apps connector
- Create a playbook to automate an incident response
- Run a playbook on demand in response to an incident
- Labs: Create a Microsoft Sentinel playbook
Module 43: Security incident management in Microsoft Sentinel
- Understand Microsoft Sentinel incident management
- Explore Microsoft Sentinel evidence and entity management
- Investigate and manage incident resolution
- Labs: Investigate an incident
Module 44: Identify threats with Behavioral Analytics
- Explain User and Entity Behavior Analytics in Azure Sentinel
- Explore entities in Microsoft Sentinel
Module 45: Data normalization in Microsoft Sentinel
- Use ASIM Parsers
- Create ASIM Parser
- Create parameterized KQL functions
Module 46: Query, visualize, and monitor data in Microsoft Sentinel
- Visualize security data using Microsoft Sentinel Workbooks
- Understand how queries work
- Explore workbook capabilities
- Create a Microsoft Sentinel Workbook
- Labs: Query and visualize data with Microsoft Sentinel Workbooks
- Labs: Visualize data using Microsoft Sentinel Workbooks
Module 47: Threat hunting with Microsoft Sentinel
- Use queries to hunt for threats
- Save key findings with bookmarks
- Observe threats over time with Livestream
- Labs: Hunt for threats by using Microsoft Sentinel
Module 48: Use Search jobs in Microsoft Sentinel
- Use Search Jobs in Microsoft Sentinel
- Restore archive logs in Microsoft Sentinel
Module 49: Hunt for threats using notebooks in Microsoft Sentinel
- Explore API libraries for advanced threat hunting in Microsoft Sentinel
- Describe notebooks in Microsoft Sentinel
- Create and use notebooks in Microsoft Sentinel
About The Certification & Examination
The prestigious SC-200 certification ensures that you are proficient in protecting an organisation’s IT systems through threat detection, monitoring, and response. This certification advances your career in cybersecurity and prepares you to become a reliable expert who can protect a large IT infrastructure and manage subtle security threats.
Duration: The exam is 100 minutes long.
Proctoring: The exam is proctored and not open-book.
Format: Includes interactive components as part of the assessment.
Retake Policy: Candidates can retake the exam 24 hours after the first attempt. Subsequent retakes have varying time intervals.
Accommodations: A variety of accommodations are available to support test-takers.
Please contact us to learn more about accommodation facilities, different language preferences, and exam fees.
Purpose: Validates skills in data protection, compliance implementation, and governance.
Choose Your Preferred Mode
Online Training
- Real-time sessions with expert trainers.
- Live Q&A and discussion opportunities with instructors and peers.
- Round-the-clock assistance for doubts and technical support.
- Virtual labs for practical exposure to tools and technologies.
Corporate Training
- Programs designed to upskill employees in specific areas.
- Encourages team-building through group activities and discussions.
- Access to industry-experienced instructors for focused training.
- Suitable for training small teams or large departments.
FAQ’s
Why should I choose Vinsys for the Microsoft Security Operations Analyst (SC-200T00) Certification Training?
Vinsys provides Microsoft Certified Trainers, hands-on lab access, official courseware, and round-the-clock learner support. Our proven track record of training over 1 million professionals ensures an industry-leading learning experience tailored to help you succeed in the SC-200 exam.
How does this course enhance my career as a cybersecurity professional?
The SC-200 certification validates your expertise in threat detection, investigation, and response using Microsoft tools, making you a preferred candidate for roles like Security Operations Analyst, Threat Hunter, and Incident Responder.
Can I take this course without prior experience in cybersecurity?
While prior experience is helpful, foundational knowledge of Azure, scripting, and Windows systems is sufficient to begin this course.
What kind of practical experience will I gain during the training?
You will work on hands-on labs, including advanced threat-hunting scenarios, KQL queries, incident response simulations, and cloud workload protection exercises.
Does the course help with configuring tools like Microsoft Sentinel and Defender?
Yes, the course covers comprehensive configurations of Microsoft Sentinel, Defender for Endpoint, Defender for Cloud, and other Microsoft security tools.
Will I receive access to additional study resources post-training?
Vinsys provides access to recorded sessions, practice assessments, and supplementary materials to ensure continued learning and exam preparation.
How is this course different from other cybersecurity certifications?
This course specifically focuses on Microsoft’s ecosystem, offering deep expertise in Microsoft Sentinel, Defender, and Azure services, which are increasingly in demand for modern security roles.
Does this course include guidance for the SC-200 exam?
Yes, the training includes exam-focused content, practice questions, and tips to ensure you are well-prepared to clear the SC-200 certification exam on your first attempt.
What is the format of the hands-on labs provided during the course?
The cloud-based labs simulate real-world scenarios, allowing you to practice KQL queries, threat detection, and incident response in a secure virtual environment.
How soon can I expect to apply the skills learned in this course to my job?
The skills acquired during this training immediately apply to real-world scenarios, enabling you to enhance your organisation’s security posture from day one.
Why Vinsys
Seasoned Instructors
Official Vendor Partnerships
Authorized Courseware
3,000+ Courses & 2,000+ Modules
In Synch with Tech-advancements
Customizable Blended Learning Options
Reviews
The training was engaging. The practical elements, such as hands-on labs and realistic cases, helped me develop a better understanding of threats and incidents. The online sessions provided enough comfort.Highly recommended!
Mahavir JainCloud Operation Engineer
Vinsys was very supportive throughout the SC-200 course. The live sessions and the exposure to tools such as Microsoft Sentinel allowed me to expand my knowledge in cybersecurity. This training has gone a long way in enhancing my promotion ladder in my line of work.
Anil Singh AswalProject Manager
The structured approach of Vinsys's SC-200 training is unmatchable. From the basics of KQL to automating incident responses, all aspects were explained in detail. The trainers were very good, and I am now certified on the first try!
Shashi KalaCyber Security Specialist
Vinsys provided us with customised SC-200 training for our team to enable them to implement threat management and security monitoring techniques. Using real-world case studies and collaborative exercises greatly enhanced our organisation's security. It is an interesting and valuable investment for any enterprise.
Monika MangrulkarChief Technical Officer
Search