Microsoft · SC-200
The Microsoft Sentinel platform
SC-200 · Lesson 5 of 14 · 25:59
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the SC-200 exam (Microsoft Certified: Security Operations Analyst Associate). In this lesson: Microsoft Sentinel roles, the analytics and data lake tiers (30 days by default, up to two years in analytics, up to twelve years in the lake), Defender XDR data retention, workbooks, SOC optimization recommendations, and the move to the Defender portal after March 31, 2027. Includes three original practice questions.
Preview the topics
- A new analyst must assign, comment on, and close incidents, but must not create or edit analytics rules. Which role fits?
- Compliance requires keeping firewall logs for seven years, at the lowest cost, while only the last thirty days are used for detections. What should the engineer configure?
- A SOC manager wants recommendations to close detection gaps against specific attacks, and to spot ingested data that brings little value. Where should they look?