5 Azure Security Labs Every SC-200 Candidate Should Complete
Azure·October 2, 2026·5 min read

5 Azure Security Labs Every SC-200 Candidate Should Complete

SC-200 tests whether you can investigate, respond to and hunt threats across Microsoft's security stack: Sentinel, Defender for Endpoint, Defender for Cloud and Defender for Identity.

It is not a theory exam. You are expected to read and write KQL, configure analytics rules, and work an incident from detection through to closure. Five labs cover the operational skills that make up most of it, and the order you do them in matters, because each one produces the thing the next one needs.

1. Deploy a Sentinel workspace

Before you can investigate anything there has to be somewhere for the data to live. This covers provisioning a Log Analytics workspace, enabling Sentinel on it, and the decisions you make at setup: retention, workspace architecture and what each choice costs.

Domain: configuring the Sentinel environment.

Deploy your first Sentinel workspace and keep it, because everything below builds on it.

Hands-on LabBeginner1 hourDeploying Your First Microsoft Sentinel Workspace on AzureLearn to set up Microsoft Sentinel workspace, connect it to a Log Analytics workspace, and prepare for advanced security monitoring and threat detection.cloudlearn.ioPractice hands-on

The exam assumes you can move around a workspace without hesitating. Questions on workspace configuration, multi workspace design and retention policy appear in the environment configuration section, and they are quick marks if you have actually built one.

2. Connect data sources

A workspace with no connectors is an empty dashboard. This covers enabling the connectors you will meet most often, Azure Activity, Entra ID and Microsoft 365, and confirming data is genuinely arriving rather than appearing to.

Domain: configuring data connectors and validating ingestion.

Enable data connectors in Sentinel against the workspace you just built.

Hands-on LabBeginner30 minutesEnabling Data Connectors in Microsoft SentinelEnable Microsoft Sentinel data connectors, ingest data from various sources, and explore associated resources like analytics rules, workbooks, and playbooks.cloudlearn.ioPractice hands-on

Knowing which connector serves which source is tested directly. The exam gives you a scenario, something like needing to ingest sign in logs, and expects you to name the connector and the permissions it requires. That is memorable after you have configured a few and vague if you have only read about them.

3. Write analytics rules

This is where Sentinel becomes a detection system rather than a log store. Analytics rules run KQL against incoming data and raise incidents when something matches.

The lab covers scheduled rules, severity, MITRE ATT&CK mapping, and the tuning work that keeps false positives from burying real signal. That last part is the difference between a rule that looks good in a demo and one a SOC can live with.

Domain: creating and managing analytics rules, KQL for security operations.

Create custom analytics rules and investigate what they produce.

Hands-on LabBeginner45 minutesCreating Custom Analytics Rules and Investigating Incidents in Microsoft SentinelLearn how to create custom analytics rules in Microsoft Sentinel, map entities to enrich alerts, and investigate incidents generated from suspicious activities.cloudlearn.ioPractice hands-on

KQL is not optional

You will read existing queries and write new ones. If where, summarize, extend, join and project are not second nature, fix that before you book the exam. This lab is useful precisely because it makes you write real queries against real data rather than recognise correct ones in a multiple choice list.

4. Work an incident end to end

Detection is half the job. The other half is triage: setting severity, investigating the entities involved, working out the scope, and recording what you did and why.

This walks the full lifecycle, and it is the section of the exam that rewards having done it rather than read it.

Domain: managing incidents, investigating threats, entity analysis.

Investigate and handle incidents in Sentinel.

Hands-on LabBeginner1 hourInvestigating and Handling Incidents in Microsoft SentinelLearn to handle incidents in Microsoft Sentinel by investigating suspicious activity, analyzing IP insights, and automating responses with custom rules.cloudlearn.ioPractice hands-on

Expect to be asked how you assign and classify an incident, when escalating beats closing, how the investigation graph traces relationships between entities, and what evidence needs to exist before an incident is closed. Those are process questions as much as product questions.

5. Secure the workloads themselves

This one looks out of place on a Sentinel list until you notice that SC-200 covers protecting cloud workloads, not just watching them. Applying Defender for Cloud recommendations and setting security policy for modern services, including AI workloads, is a growing part of the exam.

Secure Azure AI services with Defender for Cloud covers the pattern, and the pattern generalises to other workload types.

Hands-on LabIntermediate1 hourSecuring Azure AI Services: Best Practices ConfigurationSecure Azure AI Services with Private Endpoint Configuration and Network Isolation to prevent unauthorized public access and data leakage.cloudlearn.ioPractice hands-on

Do them in this order

  1. Deploy Sentinel. Nothing else works without the workspace.
  2. Connect data. You cannot detect anything without data arriving.
  3. Write rules. You cannot investigate without detections firing.
  4. Investigate. This is where the first three become one workflow.
  5. Secure workloads. Widens the picture past Sentinel itself.

Doing them out of order mostly means building things you cannot exercise yet, which is why the sequence is worth respecting even though each lab stands alone.

Find your weak domain before you study

Take a practice set after the five labs and read the per domain breakdown rather than the total. Sentinel configuration, incident response, threat hunting and workload protection fail differently, and the readiness score will tell you which one is actually holding you back.

Certification PrepAzure4SC-200: Microsoft Security Operations AnalystPractice sets covering Sentinel, Defender, KQL, and incident responselabs.cloudlearn.ioStart prepping

Related reading

SC-200 is one of the more honest security certifications, in the sense that the exam closely resembles the work. If you can complete these five labs without help, you are most of the way there.

Practice it hands-on

Labs where you can apply what this article covers, in a real environment.

Free
Hands-on Lab1 hour

Deploying Your First Microsoft Sentinel Workspace on Azure

Learn to set up Microsoft Sentinel workspace, connect it to a Log Analytics workspace, and prepare for advanced security monitoring and threat detection.

cloudlearn.ioStart lab
Hands-on Lab1 hour and 5 minutes

Deploy Microsoft Sentinel End-to-End with Terraform on Azure

Stand up a complete Microsoft Sentinel foundation as code - workspace, onboarding, threat intelligence indicator, scheduled rule, and automation rule - with Terraform.

cloudlearn.ioStart lab
Hands-on Lab1 hour

Implement Network Security Groups (NSGs) and Application Security Groups (ASGs) in Azure

Secure Azure VMs using Network Security Groups and Application Security Groups. Create rules, control traffic flow, and implement least privilege access.

cloudlearn.ioStart lab