Practice exam only
€18.99
30 days · Labs not included.
View exam access →SC-200 · Hands-on practice
SC-200 Hands-on Labs — practise in a simulated Microsoft Defender portal
Learn it. Practise it. Make it stick.
50 practical tasks. Investigate supplied security evidence, run supported local hunting queries and configure detection and response controls. Independent simulation — no real tenant, device or cloud resources.
First five tasks are free, repeatable and have no expiry · No credit card required.
Access options
One-time payments, no automatic renewal. The first five tasks stay free either way.
SC-200 Hands-on Labs
€14.99
All labs for this course. 30 days from payment confirmation.
One-time payment · No automatic renewal.
Purchases are temporarily unavailable. Enjoy your 5 open tasks.
SC-200 Practice Exam + Hands-on Labs
€29.99
Save €3.99. Exam and all labs each get 60 days.
One-time payment · No automatic renewal.
Purchases are temporarily unavailable. Enjoy your 5 open tasks.
Certificate of Completion
Finish the course. Prove it.
Complete all 50 labs and you can download a certificate of completion with your name, the skills you practised and a unique ID. Challenges are optional. Anyone can check it on a public verification page — and add it to LinkedIn in one click.
- Not self-declared. Before issuing, our server re-runs the grader on every lab you saved, so a checkbox in your browser is not enough.
- Verifiable. Every certificate has its own page at examitlab.com/verify/<ID>.
- Honest. It certifies that you completed this course. It is independent training, not an official certification.
ExamIT Lab
Certificate of Completion
Security Operations
Hands-on skills course · SC-200 track · 50 graded labs
Alex Morgan
has completed every hands-on lab of the course. Each task was graded on the evidence handled and the response left in a simulated security operations workspace — not on the clicks made.
Incident triageThreat huntingDetection rulesAutomationInvestigationData connectorsReportingResponse
Completed
4 October 2026
4 October 2026
50/50labs
Certificate ID
SOC-7K4Q-2M9D-X8
SOC-7K4Q-2M9D-X8
Verify at examitlab.com/verify/SOC-7K4Q-2M9D-X8. This is a certificate of course completion issued by ExamIT Lab. It is independent training and not an official certification of any vendor.
Sample certificate — name and ID are fictional.
Your learning path
Follow the suggested learning order or repeat any task independently. Each lab supplies its own prepared scenario; changes stay within that task.
LAB 01 · FREE
Triage and remediate a correlated phishing and account takeover incident
Incident response · Defender XDR · 25–30 min
Open lab →LAB 02 · FREE
Investigate and contain an endpoint using evidence and live response
Incident response · Defender for Endpoint · 25–30 min
Open lab →LAB 03 · FREE
Hunt a password spray and verify the successful account takeover
Threat hunting · Advanced hunting · 25–30 min
Open lab →LAB 04 · FREE
Create a scheduled analytics rule and narrowly scoped incident automation
Security operations environment · Microsoft Sentinel · 30–35 min
Open lab →LAB 05 · FREE
Tune a finance ASR exclusion without weakening the estate baseline
Security operations environment · Attack surface reduction · 25–30 min
Open lab →LAB 06 · LOCKED
Classify Cloud Apps anomalies and apply proportionate response actions
Respond to security incidents · Microsoft Defender for Cloud Apps · 30–35 min
Included with full SC-200 lab access
LAB 07 · LOCKED
Scope an alert-tuning rule to the authorized vulnerability scanner
Security operations environment · Alert tuning · 30–35 min
Included with full SC-200 lab access
LAB 08 · LOCKED
Collect appliance text logs through AMA into an analytics-ready table
Security operations environment · Microsoft Sentinel data connectors · 30–35 min
Included with full SC-200 lab access
LAB 09 · LOCKED
Scope and investigate a departing user’s Purview Audit search
Respond to security incidents · Microsoft Purview Audit · 30–35 min
Included with full SC-200 lab access
LAB 10 · LOCKED
Analyze blast-radius paths and test a targeted containment decision
Perform threat hunting · Blast radius and entity relationships · 30–35 min
Included with full SC-200 lab access
LAB 11 · LOCKED
Review pending automated actions against each entity’s investigation verdict
Respond to security incidents · Automated investigation and response · 30–35 min
Included with full SC-200 lab access
LAB 12 · LOCKED
Investigate a cloud compromise and suppress only authorized scanner noise
Respond to security incidents · Microsoft Defender for Cloud · 35–40 min
Included with full SC-200 lab access
LAB 13 · LOCKED
Build a scoped continuous custom detection from a hunting query
Manage a security operations environment · Custom detections in Microsoft Defender XDR · 35–40 min
Included with full SC-200 lab access
LAB 14 · LOCKED
Rank device groups and keep domain controllers outside full automation
Manage a security operations environment · Device groups, permissions and automation levels · 30–35 min
Included with full SC-200 lab access
LAB 15 · LOCKED
Distinguish impacted and exposed assets in a threat analytics report
Perform threat hunting · Threat analytics in Microsoft Defender XDR · 30–35 min
Included with full SC-200 lab access
LAB 16 · LOCKED
Validate five SOC optimization recommendations before changing detection coverage
Manage a security operations environment · SOC optimization · 35–40 min
Included with full SC-200 lab access
LAB 17 · LOCKED
Correlate Identity alerts and classify authorized activity without hiding an intrusion
Respond to security incidents · Microsoft Defender for Identity · 35–40 min
Included with full SC-200 lab access
LAB 18 · LOCKED
Measure a threat scenario’s MITRE coverage using active mapped detections
Manage a security operations environment · MITRE ATT&CK coverage · 35–40 min
Included with full SC-200 lab access
LAB 19 · LOCKED
Create a workbook panel that accurately trends failed cloud sign-ins
Manage a security operations environment · Microsoft Sentinel workbooks · 30–35 min
Included with full SC-200 lab access
LAB 20 · LOCKED
Verify Copilot incident claims before applying guided response actions
Respond to security incidents · agentic AI and embedded Microsoft Security Copilot · 35–40 min
Included with full SC-200 lab access
LAB 21 · LOCKED
Build an eDiscovery search with precise sources and Boolean conditions
Respond to security incidents · Microsoft Purview eDiscovery · 35–40 min
Included with full SC-200 lab access
LAB 22 · LOCKED
Configure narrow disruption exclusions and review actual automatic response
Manage a security operations environment · Automatic attack disruption · 35–40 min
Included with full SC-200 lab access
LAB 23 · LOCKED
Create scoped expiring threat indicators and validate their ingestion
Manage a security operations environment · Threat intelligence in Microsoft Sentinel · 35–40 min
Included with full SC-200 lab access
LAB 24 · LOCKED
Right-size table tiers and retention without losing required security data
Manage a security operations environment · Microsoft Sentinel data retention and tiers · 35–40 min
Included with full SC-200 lab access
LAB 25 · LOCKED
Use Graph activity evidence to identify malicious application access
Respond to security incidents · Microsoft Graph activity logs · 35–40 min
Included with full SC-200 lab access
LAB 26 · LOCKED
Assign Sentinel roles separately for incident work and data-lake jobs
Manage a security operations environment · Microsoft Sentinel roles and permissions · 35–40 min
Included with full SC-200 lab access
LAB 27 · LOCKED
Collect Windows events and adapt detections to the correct destination table
Manage a security operations environment · Ingest data sources · 40–45 min
Included with full SC-200 lab access
LAB 28 · LOCKED
Use Azure Policy to collect the authorized subscriptions’ activity logs
Manage a security operations environment · Ingest data sources · 40–45 min
Included with full SC-200 lab access
LAB 29 · LOCKED
Flight a customized anomaly rule against labeled attack and noise examples
Manage a security operations environment · Configure protections and detections · 30–35 min
Included with full SC-200 lab access
LAB 30 · LOCKED
Design a data-lake KQL job that preserves historical event time
Perform threat hunting · Microsoft Sentinel data lake, KQL jobs and notebooks · 45–50 min
Included with full SC-200 lab access
LAB 31 · LOCKED
Authorize and connect an approval-gated Sentinel playbook workflow
Manage a security operations environment · Configure automation in Microsoft Sentinel · 35–40 min
Included with full SC-200 lab access
LAB 32 · LOCKED
Choose NRT only where timing, source latency and capacity justify it
Manage a security operations environment · Configure protections and detections · 30–35 min
Included with full SC-200 lab access
LAB 33 · LOCKED
Separate Syslog and CEF collection streams without losing required events
Manage a security operations environment · Ingest data sources · 40–45 min
Included with full SC-200 lab access
LAB 34 · LOCKED
Configure endpoint advanced features and narrowly targeted custom collection
Manage a security operations environment · Configure settings in Microsoft Defender XDR · 35–40 min
Included with full SC-200 lab access
LAB 35 · LOCKED
Preserve hunting evidence with bookmarks in the supported portal experience
Perform threat hunting · Detect threats using Microsoft Sentinel · 40–45 min
Included with full SC-200 lab access
LAB 36 · LOCKED
Investigate a Sentinel-origin incident and repair its missing entity mapping
Respond to security incidents · Microsoft Sentinel incidents in the Defender portal · 35–40 min
Included with full SC-200 lab access
LAB 37 · LOCKED
Investigate Purview alerts and deliberately configure DLP behavior tuning
Respond to security incidents · Threats identified by Microsoft Purview · 35–40 min
Included with full SC-200 lab access
LAB 38 · LOCKED
Trace a cross-forest attack and respect identity response prerequisites
Respond to security incidents · Lateral movement across domains · 40–45 min
Included with full SC-200 lab access
LAB 39 · LOCKED
Repair threat-indicator analytics and distinguish documented behavior from inference
Manage a security operations environment · Configure protections and detections · 35–40 min
Included with full SC-200 lab access
LAB 40 · LOCKED
Use the correct correlation engine and scope incident notification rules
Manage a security operations environment · Configure protections and detections · 35–40 min
Included with full SC-200 lab access
LAB 41 · LOCKED
Apply endpoint indicators without blocking approved business services
Manage a security operations environment · Configure settings in Microsoft Defender XDR · 35–40 min
Included with full SC-200 lab access
LAB 42 · LOCKED
Summarize high-volume logs into a detection-ready analytics table
Perform threat hunting · Hunt for threats using Microsoft Sentinel · 35–40 min
Included with full SC-200 lab access
LAB 43 · LOCKED
Correlate phishing mail and device execution with explicit join semantics
Threat hunting · Advanced hunting · 40–45 min
Included with full SC-200 lab access
LAB 44 · LOCKED
Trace lateral movement by SID and contain only the verified pivot
Threat hunting · Advanced hunting · 40–45 min
Included with full SC-200 lab access
LAB 45 · LOCKED
Investigate risky users and rehearse migration from retired risk policies
Respond to security incidents · Microsoft Entra ID Protection · 45–50 min
Included with full SC-200 lab access
LAB 46 · LOCKED
Remediate Explorer messages using actual delivery location and submission evidence
Respond to security incidents · Microsoft Defender for Office 365 · 45–50 min
Included with full SC-200 lab access
LAB 47 · LOCKED
Create precise watchlists and join detections by the intended SearchKey
Manage a security operations environment · Microsoft Sentinel · 45–50 min
Included with full SC-200 lab access
LAB 48 · LOCKED
Choose search or restore for archived logs and clean up temporary data
Manage a security operations environment · Microsoft Sentinel · 45–50 min
Included with full SC-200 lab access
LAB 49 · LOCKED
Build and activate a narrowly scoped tier-one Defender role
Manage a security operations environment · Microsoft Defender XDR · 45–50 min
Included with full SC-200 lab access
LAB 50 · LOCKED
Coordinate a campaign case without confusing case and incident status
Respond to security incidents · Microsoft Defender XDR · 45–50 min
Included with full SC-200 lab access
SC-200 hands-on labs — questions
- Does SC-200 have labs, and can I practise them without a tenant?
- Yes. ExamIT Lab gives you 50 guided SC-200 labs in a simulated Microsoft Defender portal. Nothing is deployed to a real Microsoft tenant, subscription or device, so there is nothing to set up, nothing to pay Microsoft for, and nothing you can break.
- Are the SC-200 labs free?
- The first 5 labs in the learning order are free, repeatable and never expire — no credit card and no sign-up required to start. The full course of 50 labs is a one-time purchase with no subscription.
- What does a SC-200 lab look like?
- Each of the 50 independent tasks supplies a fictional security case, optional guidance, three gradual hints and checks of saved configuration or supported investigation results. The workspace includes selected Defender, Sentinel, Entra and Purview views. Evidence and analyst decision exercises are labelled separately from product configuration.
- Do the labs cover the current SC-200 exam outline?
- The 50 original tasks practise selected objectives from Microsoft's SC-200 study guide, skills measured as of October 21, 2026. They cover security operations management, incident response and threat hunting. Some workflows use historical portal experiences or supplied evidence, identified within the task. This is not complete coverage of every exam objective; use the official study guide and Microsoft Learn alongside the course.
- Is there a certificate at the end?
- Yes. When all 50 labs are complete you can issue a certificate of completion in your account: a PDF with your name and a unique ID, an Add to LinkedIn link and a public verification page. Before issuing, the server re-runs the course grader on every lab you saved, so it reflects work you really did. It certifies completion of this course; it is independent training, not an official certification.
- How is this different from a Microsoft Learn sandbox or a trial tenant?
- These repeatable browser cases provide fictional incidents, devices, logs and policies. Supported hunting queries execute locally over supplied data; some detection-rule tasks check configuration against authored sample evidence. The simulator cannot execute arbitrary KQL, connect to Microsoft services, investigate real devices or change a tenant. Use a real training environment for operations outside the supported workflows.
Access is per course. Sign in for account progress. After paid access expires, your saved progress is retained and the first five tasks remain free.