SC-200 Exam Prep
18 visual workflow lessons supporting SC-200 study: investigate with Defender XDR, work with Sentinel data and detections, and verify cloud security controls. Includes worked examples, captions and knowledge checks.
Defender XDR: Architecture and the Unified Portal
Open every lesson free. Watch or read, try the knowledge check, then choose your next lesson. Sign in only to save completed progress.
October 2026 visual edition: short scenario-led videos with synthetic American-English narration, diagrams, captions and practice questions. Allow extra time for reading and hands-on practice.
These focused lessons support your study; they do not cover every current exam objective. Check the current Microsoft SC-200 study guide when planning exam preparation.
Watch the complete visual edition on YouTubeCourse curriculum
- L1. Defender XDR: Architecture and the Unified Portal
- L2. Defender for Endpoint: Onboarding and Alert Triage
- L3. Defender for Office 365: Email Threat Protection
- L4. Defender for Identity: Lateral Movement Detection
- L5. Defender for Cloud Apps: Shadow IT and App Governance
- L6. Incident Management: Correlation, Triage and Response
- L7. Sentinel Architecture: Workspaces, Connectors and Costs
- L8. Data Connectors: Ingesting Logs at Scale
- L9. KQL Fundamentals: Querying Security Data
- L10. Analytics Rules: Scheduled, NRT and Fusion
- L11. Sentinel Incidents: Investigation and Evidence
- L12. Automation and SOAR: Playbooks with Logic Apps
- L13. Workbooks and Threat Hunting
- L14. Watchlists, Threat Intelligence and UEBA
Practice Exam: Arcade Mode
50 questions, 45 minutes, instant feedback, XP streaks, and domain breakdown.