Prep-Set-Go SC-200: Microsoft Security Operations Analyst

Duration and Schedule

4.5 hours

Student Kit Inclusions

During the course you will be provided access to:

• Microsoft Official curriculum (MOC) e-book
• Microsoft Azure subscription (valid for 30 days) for hands on labs practice
• Microsoft 365 Trial Tenant credentials

At course completion you will be provided:

• Certification Exam Voucher 

What you will learn

In this fast track exam prep course we will do a quick recap of all the important technology skills covered in Exam SC-200 including topics like:

• Explain how Microsoft Defender for Endpoint can remediate risks in your environment
• Create a Microsoft Defender for Endpoint environment
• Configure Attack Surface Reduction rules on Windows 10 devices
• Perform actions on a device using Microsoft Defender for Endpoint
• Investigate domains and IP addresses in Microsoft Defender for Endpoint
• Investigate user accounts in Microsoft Defender for Endpoint
• Configure alert settings in Microsoft Defender for Endpoint
• Explain how the threat landscape is evolving
• Conduct advanced hunting in Microsoft 365 Defender
• Manage incidents in Microsoft 365 Defender
• Explain how Microsoft Defender for Identity can remediate risks in your environment.
• Investigate DLP alerts in Microsoft Cloud App Security
• Explain the types of actions you can take on an insider risk management case.
• Configure auto-provisioning in Azure Defender
• Remediate alerts in Azure Defender
• Construct KQL statements
• Filter searches based on event time, severity, domain, and other relevant data using KQL
• Extract data from unstructured string fields using KQL
• Manage an Azure Sentinel workspace
• Use KQL to access the watchlist in Azure Sentinel
• Manage threat indicators in Azure Sentinel
• Explain the Common Event Format and Syslog connector differences in Azure Sentinel
• Connect Azure Windows Virtual Machines to Azure Sentinel
• Configure Log Analytics agent to collect Sysmon events
• Create new analytics rules and queries using the analytics rule wizard
• Create a playbook to automate an incident response
• Use queries to hunt for threats
• Observe threats over time with livestream