Security Operations Analyst study guide

Learn it in this order

Each block builds on the one before it. Doing them out of order is the usual reason people find Sentinel confusing: it is much easier once you already know what an incident looks like in Defender XDR.

• Weeks 1 to 2. Defender XDR end to end: what generates an alert, how alerts become an incident, and what the response actions actually do to a device or an account.
• Weeks 2 to 4. Microsoft Sentinel: connectors, analytics rules, incidents, workbooks and automation. Build one rule from scratch and watch it fire.
• Weeks 4 to 5. KQL. Not the whole language, the twenty operators that appear constantly, and the shape of a hunting query.
• Weeks 5 to 6. Defender for Cloud and the other Defender products, at the depth of knowing which one owns which problem.
• Weeks 6 onwards. Practice tests, then go back to whichever area scored worst. Repeat until the worst area stops being the worst.

The KQL you actually need

People overprepare here. The exam does not ask you to write long queries from memory; it asks you to recognise which operator answers a question. Learn these well enough to spot them in an answer list and you have covered most of what appears.

• where, project, extend, summarize, count, distinct: the everyday four fifths.
• join and its kinds, particularly which side of the join survives. This is a favourite.
• arg_max and arg_min: which row, as against which value.
• make_set and make_list: the collection, as against the number.
• has against contains: whole terms and the index, against scanning every character.
• bin and ago for time windows, and let for anything you would otherwise repeat.

Where people lose marks

These are the recurring traps. None of them are obscure; they are all cases where the obvious-looking answer is one step off.

• Choosing an action that treats the alert instead of the incident. The exam rewards working the incident.
• Reaching for a custom analytics rule when a supplied one already covers the technique.
• Missing that a question is about a connector's data, not the product's own settings.
• Confusing what automation may do by itself with what needs an analyst to approve it.
• Forgetting that some response actions require the antivirus to be in active mode.

What the exam weights, and what that means for your time

Microsoft publishes the weighting and it is worth taking literally when you plan your weeks. The areas are not equal, and the smallest one attracts the most over-preparation because it is the most enjoyable to study.

Hunting is the part people look forward to and it carries the least weight. Learn it properly, and do not spend three weeks on KQL while the questions about connectors and collection go unread.

• Running a security operations setup, 40 to 45%. Automation, alert tuning, Defender for Endpoint settings, device groups, Sentinel data collection and detection rules.
• Responding to incidents, 35 to 40%. Investigating and fixing threats across email, identity, endpoints, cloud apps and Microsoft 365 activity.
• Hunting for threats, 20 to 25%. Writing KQL queries, picking the right table, reading threat analytics, and hunting across Defender and Sentinel.

Build these in a lab, once each

The questions are scenario-shaped, and the fastest way to recognise a scenario is to have been in it. A trial tenant is enough for all of these, and each takes under an hour.

• Onboard one device to Defender for Endpoint and watch what arrives, including how long it takes.
• Connect one data source to Sentinel and find its table. Then break the connection and see what the health data shows.
• Write one analytics rule, make it fire deliberately, and follow the incident it creates through to closure.
• Attach one automation rule and one playbook, and note which permission each needed and where that permission lives.
• Run an isolation action on a test device, then release it. Knowing what a responder sees is worth several exam questions.
• Turn on a data collection rule, then change it, so you have seen that what is collected is decided there and not on the agent.

The week before

Stop learning new material about five days out. The marginal question you learn is worth less than the confidence of knowing the material you already have.

• Sit two full timed tests, at the time of day your exam is booked for.
• Read back every question you got wrong, and say out loud why the right answer wins. If you cannot, that topic is not finished.
• Re-read the skills outline itself. It is short, and it is the closest thing to a syllabus you will get.
• Check the practicalities: identification, the room if you are testing at home, and the software if you have not used it before.

How to use practice tests alongside this

Sit a test early, before you feel ready. The point is not the score, it is finding the two topics where you are weakest so you can spend your time there rather than revising everything evenly.

Then sit one again at the end of each block above. If a topic keeps scoring badly after two attempts, the problem is usually that you have read about it rather than done it: build the rule, run the query, trigger the alert in a lab.