SC-200 Microsoft Security Operations Analyst

SC-200 (Microsoft Security Operations Analyst) ist die SOC-Analyst-Zertifizierung für Microsoft-Security-Tools. Sie verantwortet die Erkennung, Untersuchung und Reaktion auf aktive Bedrohungen in der Microsoft-Sicherheitslandschaft. Themen: 1. Microsoft Defender XDR (Extended Detection and Response, ehemals Microsoft 365 Defender) als Cross-Domain-Suite: Microsoft Defender for Endpoint (EDR mit Threat & Vulnerability Management, Attack Surface Reduction, Next-Gen Protection mit ML-basiertem AV, Endpoint Detection and Response mit Live Response Shells, Automated Investigation and Response AIR), Microsoft Defender for Identity (ehemals Azure ATP — On-Premises AD Threat Detection, Lateral Movement, Pass-the-Hash, Golden Ticket), Microsoft Defender for Office 365 (Safe Attachments, Safe Links, Anti-Phishing mit Mailbox Intelligence, Attack Simulation Training), Microsoft Defender for Cloud Apps (CASB — Shadow IT Discovery, Conditional Access App Control, Information Protection für SaaS). 2. Microsoft Defender for Cloud (ehemals Azure Security Center): Multi-Cloud (AWS, GCP) Cloud Security Posture Management (CSPM), Cloud Workload Protection Platform (CWPP) für Server, Container, Databases, Storage; Secure Score und Regulatory Compliance Dashboard. 3. Microsoft Sentinel (Cloud-Native SIEM/SOAR): Data Connectors (100+ — Azure, M365, AWS, syslog, CEF, custom REST), Analytics Rules (Scheduled, Microsoft Security, NRT Near-Real-Time, Fusion Rules mit ML, Anomaly), Incidents-Workflow, Investigation Graph, Hunting Queries mit KQL (Kusto Query Language), Notebooks für Advanced Hunting, Workbooks für Dashboards, Watchlists, Threat Intelligence-Integration (MISP, TAXII), Playbooks (Logic Apps für SOAR-Automation — Auto-Containment, Ticket-Creation, Enrichment), UEBA (User and Entity Behavior Analytics). 4. KQL für Sicherheitsabfragen: where, summarize, join, project, mv-expand, parse, render. Häufige Hunting-Queries und MITRE ATT&CK Mapping. 5. Threat Hunting proaktiv mit Notebooks und Advanced Hunting Queries. 6. Incident Response Lifecycle (Preparation, Detection, Analysis, Containment, Eradication, Recovery, Lessons Learned). Examen: ~50 Fragen, 100 Minuten, 700/1000 Pass.