16%

Ransom detonations against enterprises rose 15.8% year on year. Microsoft Digital Defense Report 2026.

Microsoft Certified: Security Operations Analyst Associate (SC-200) certification

Ransom Attacks Are Up.
Hunt Them.

Ransom detonations against enterprises rose 15.8% in a year. SC-200 proves you can detect, investigate and stop attacks with Microsoft Defender XDR and Sentinel.

HRD Corp claimableYayasan Peneraju: may be eligibleKL or online

Exam

SC-200

Course

4 days

Course fee

RM3,000

With exam

RM3,374

Next intake

2 Feb 2027

Quick answer

What is Microsoft Certified: Security Operations Analyst Associate?

Microsoft Certified: Security Operations Analyst Associate validates that you can run security operations with Microsoft tools: configure Microsoft Sentinel and Defender XDR, respond to incidents, and hunt threats with KQL. One 100-minute exam, SC-200, earns it.

Exam facts verified against learn.microsoft.com on 23 Oct 2026

FOR

SOC analysts and security staff working with Microsoft tools

ROLES

Security operations analyst, SOC analyst, incident responder, threat hunter

SKIP IF

Microsoft security is new to you. Start with SC-900

01

The Credential

What you study, practise and sit to earn it.

Pass one exam, SC-200, and you hold Microsoft Certified: Security Operations Analyst Associate. It proves you can triage, respond and hunt across Microsoft’s security stack.

COURSE

4 days, SC-200T00

HANDS-ON

Microsoft Official Course labs

EXAM

SC-200, 100 min

CREDENTIAL

Microsoft Certified Associate

Awarded by

Microsoft

Level

Intermediate, associate

Prerequisites

None formal

Recommended

Microsoft 365, Azure and Microsoft security tools

Validity

12 months, renew free online

Covers

Defender XDR, Sentinel, Defender for Endpoint, KQL

02

Decide in 60 Seconds

Four options people weigh against each other.

If you want to

Choose

Why

Investigate and respond with Microsoft tools

→

SC-200

Defender XDR, Sentinel and threat hunting with KQL

Secure Azure, data and AI workloads

→

SC-500

Microsoft’s cloud and AI security engineering credential

Vendor-neutral analyst skills

→

CompTIA CySA+

Detection and response on any vendor’s tools

Prove SOC skills in a hands-on exam

→

ISACA CCOA

Performance-based exam on real tools

No formal prerequisites. But are you ready?
0/4

Tick what applies. 3 or 4: you are ready for this course. Fewer: start with SC-900.

03

What the Exam Covers

Skills measured for exam SC-200. Bars to scale.

3 skill areasLargest: Manage a SecOps Environment, 40 to 45%

Manage a Security Operations Environment · 40–45%
Respond to Security Incidents · 35–40%
Perform Threat Hunting · 20–25%

Source: Microsoft Learn SC-200 study guide. Microsoft publishes weightings as ranges; bars show the midpoint.

04

What the Course Covers

Microsoft Official Course SC-200T00, mapped to the three skill areas.

Four days of Microsoft Official Course training. You set up Sentinel and Defender XDR, respond to real incidents, then hunt for the threats that slipped past the alerts.

40 to 45%

Run the SecOps Environment

  • Configure the Microsoft Sentinel SIEM and platform
  • Ingest data into Sentinel
  • Configure detections
  • Automation in Defender XDR and Sentinel

35 to 40%

Respond to Incidents

  • Alerts and incidents in Microsoft Defender XDR
  • Device investigations in Defender for Endpoint
  • Investigate Microsoft 365 activity

20 to 25%

Hunt Threats

  • Hunt with Microsoft Defender XDR
  • Hunt with the Microsoft Sentinel platform
  • Build queries with KQL

Labs

in Microsoft Defender XDR and Microsoft Sentinel, alongside instructor-led sessions.

05

Why Now

How attacks are growing, what attackers take, and why train with us.

15.8%

year-on-year increase in ransom detonations against enterprises

Microsoft Digital Defense Report 2026

63%

of intrusions Microsoft observed involved data theft

Microsoft Digital Defense Report 2026

145M+

QR-code phishing attacks detected by Microsoft Defender for Office 365 in a year

Microsoft Digital Defense Report 2026

6 hrs

Six Hours to Report. Who’s Watching the Alerts?

Malaysia’s Cyber Security Act 2024 (Act 854) came into force on 26 August 2024. Critical infrastructure entities must report a cyber security incident within six hours, and managed SOC monitoring services now need a licence. That clock starts with an analyst spotting the incident.

NACSA; Cyber Security (Notification of Cyber Security Incident) Regulations 2024

Microsoft Solutions Partner, Training Services

Delivering the Microsoft Official Course SC-200T00

Exam add-on

Add your exam for RM374

HRD Corp registered

This course is HRD Corp claimable

KL or online

Instructor-led in class or live online

06

The Cost, All In

Every figure per person, in ringgit.

Fees

Four-day courseRM3,000

Exam add-on (SC-200)RM374

Funding

HRD Corp claim for employersClaimable

Yayasan Peneraju financing (Bumiputera)May be eligible

Course with exam

RM3,374

RM3,000 + RM374

Dates

Where

Fee

Tue 2 to Fri 5 Feb 2027

Kuala Lumpur or online

RM3,000 / RM3,374 with exam

Mon 26 to Thu 29 Apr 2027

Kuala Lumpur or online

RM3,000 / RM3,374 with exam

Mon 14 to Thu 17 Jun 2027

Kuala Lumpur or online

RM3,000 / RM3,374 with exam

Mon 9 to Thu 12 Aug 2027

Kuala Lumpur or online

RM3,000 / RM3,374 with exam

Training a team? We run private intakes on dates that suit your organisation, with HRD Corp claims handled alongside you.

07

Exam and Renewal

What exam day looks like, and what happens after you pass.

Certification

Microsoft Certified: Security Operations Analyst Associate

Exam

SC-200

Duration

100 minutes, proctored

Passing score

700 or greater

Languages

English, Japanese, Chinese, Korean, German, French, Italian, Portuguese (Brazil), Spanish

Scheduling

Through Pearson VUE

Retakes

After 24 hours for a second attempt

Exam add-on

RM374 through Trainocate

EVERY 12 MONTHS

Renew free online

Microsoft associate certifications expire after a year. Renew at no cost by passing an online assessment on Microsoft Learn.

STAY CURRENT

Learn what changed

The renewal assessment covers the latest product updates, so your skills stay in step with Microsoft security.

FAQ

Questions People Ask

What is SC-200?

SC-200, Microsoft Security Operations Analyst, is the exam for Microsoft Certified: Security Operations Analyst Associate. It covers managing a security operations environment, responding to incidents and threat hunting.

Microsoft updated the skills measured on 21 Oct 2026 with a minor change to ingesting data into the Microsoft Sentinel SIEM and platform. The three skill areas and their weightings stay the same.

At Trainocate Malaysia the four-day SC-200T00 course is RM3,000 per person, or RM3,374 with the exam. The course is HRD Corp claimable, and Malaysian Bumiputera learners may be eligible for Yayasan Peneraju funding.

A proctored 100-minute exam, scheduled through Pearson VUE. You need 700 or more to pass. If you fail, you can retake it after 24 hours.

It helps. Threat hunting makes up 20 to 25% of the exam and relies on Kusto Query Language. The course teaches the KQL you need.

Take SC-200 if your SOC runs on Microsoft Defender and Sentinel. Take CySA+ for vendor-neutral analyst skills. Many analysts hold both.

The certification is valid for 12 months. Renew it free by passing an online assessment on Microsoft Learn.

Take the Lead in Your SOC

Pick an intake. An advisor confirms fees, HRD Corp claims and Yayasan Peneraju eligibility with you.

  • Next intake: 2 to Fri 5 Feb 2027
  • RM3,000, or RM3,374 with exam

Sources

  1. Microsoft Learn: Security Operations Analyst Associate
  2. Microsoft Learn: SC-200 study guide
  3. Microsoft Learn: Renew your Microsoft certification
  4. Microsoft: Digital Defense Report 2026
  5. Trainocate: SC-200T00 course page
  6. NACSA: Cyber Security Act 2024 (Act 854)
  7. MAICSA: Act 854 regulations summary