Microsoft Security Operations Analyst Exam Ref SC-200 Certification Guide
Manage, monitor, and respond to threats using Microsoft Security Stack for securing IT systems
Published on 14. April 2022
Book
Paperback/Softback
288 pages
978-1-80323-189-1 (ISBN)
Description
Remediate active attacks to reduce risk to the organization by investigating, hunting, and responding to threats using Microsoft Sentinel, Microsoft Defender for Cloud, and Microsoft 365 Defender
Key Features
Detect, protect, investigate, and remediate threats using Microsoft Defender for endpoint
Explore multiple tools using the M365 Defender Security Center
Get ready to overcome real-world challenges as you prepare to take the SC-200 exam
Book DescriptionSecurity in information technology has always been a topic of discussion, one that comes with various backgrounds, tools, responsibilities, education, and change! The SC-200 exam comprises a wide range of topics that introduce Microsoft technologies and general operations for security analysts in enterprises. This book is a comprehensive guide that covers the usefulness and applicability of Microsoft Security Stack in the daily activities of an enterprise security operations analyst.
Starting with a quick overview of what it takes to prepare for the exam, you'll understand how to implement the learning in real-world scenarios. You'll learn to use Microsoft's security stack, including Microsoft 365 Defender, and Microsoft Sentinel, to detect, protect, and respond to adversary threats in your enterprise. This book will take you from legacy on-premises SOC and DFIR tools to leveraging all aspects of the M365 Defender suite as a modern replacement in a more effective and efficient way.
By the end of this book, you'll have learned how to plan, deploy, and operationalize Microsoft's security stack in your enterprise and gained the confidence to pass the SC-200 exam.
What you will learn
Discover how to secure information technology systems for your organization
Manage cross-domain investigations in the Microsoft 365 Defender portal
Plan and implement the use of data connectors in Microsoft Defender for Cloud
Get to grips with designing and configuring a Microsoft Sentinel workspace
Configure SOAR (security orchestration, automation, and response) in Microsoft Sentinel
Find out how to use Microsoft Sentinel workbooks to analyze and interpret data
Solve mock tests at the end of the book to test your knowledge
Who this book is forThis book is for security professionals, cloud security engineers, and security analysts who want to learn and explore Microsoft Security Stack. Anyone looking to take the SC-200 exam will also find this guide useful. A basic understanding of Microsoft technologies and security concepts will be beneficial.
Key Features
Detect, protect, investigate, and remediate threats using Microsoft Defender for endpoint
Explore multiple tools using the M365 Defender Security Center
Get ready to overcome real-world challenges as you prepare to take the SC-200 exam
Book DescriptionSecurity in information technology has always been a topic of discussion, one that comes with various backgrounds, tools, responsibilities, education, and change! The SC-200 exam comprises a wide range of topics that introduce Microsoft technologies and general operations for security analysts in enterprises. This book is a comprehensive guide that covers the usefulness and applicability of Microsoft Security Stack in the daily activities of an enterprise security operations analyst.
Starting with a quick overview of what it takes to prepare for the exam, you'll understand how to implement the learning in real-world scenarios. You'll learn to use Microsoft's security stack, including Microsoft 365 Defender, and Microsoft Sentinel, to detect, protect, and respond to adversary threats in your enterprise. This book will take you from legacy on-premises SOC and DFIR tools to leveraging all aspects of the M365 Defender suite as a modern replacement in a more effective and efficient way.
By the end of this book, you'll have learned how to plan, deploy, and operationalize Microsoft's security stack in your enterprise and gained the confidence to pass the SC-200 exam.
What you will learn
Discover how to secure information technology systems for your organization
Manage cross-domain investigations in the Microsoft 365 Defender portal
Plan and implement the use of data connectors in Microsoft Defender for Cloud
Get to grips with designing and configuring a Microsoft Sentinel workspace
Configure SOAR (security orchestration, automation, and response) in Microsoft Sentinel
Find out how to use Microsoft Sentinel workbooks to analyze and interpret data
Solve mock tests at the end of the book to test your knowledge
Who this book is forThis book is for security professionals, cloud security engineers, and security analysts who want to learn and explore Microsoft Security Stack. Anyone looking to take the SC-200 exam will also find this guide useful. A basic understanding of Microsoft technologies and security concepts will be beneficial.
More details
Language
English
Place of publication
Birmingham
United Kingdom
Dimensions
Height: 235 mm
Width: 191 mm
Thickness: 16 mm
Weight
543 gr
ISBN-13
978-1-80323-189-1 (9781803231891)
Copyright in bibliographic data and cover images is held by Nielsen Book Services Limited or by the publishers or by their respective licensors: all rights reserved.
Schweitzer Classification
Persons
Trevor Stuart has over 15 years of experience in IT. He started with SMS and Active Directory and maintained exposure in the field through various naming changes and technical additions. Trevor has a passion for IT but more so with Cybersecurity. Trevor swiftly moved into Cybersecurity and focused on securing privileged access, hardening operating systems, implementing tiering within AD, tying identities to modern authentication mechanisms, scaling out the identity to the hybrid world, application migration in secure manners in Azure, and leveraging built-in security controls in multiple clouds and platforms to secure workloads. Trevor is a technology enthusiast at heart and the world of Cybersecurity only lights the fire of passion inside of him.
Joe Anich has 13 years of experience in the IT industry ranging from endpoint management with a focus in SCCM and Intune, to endpoint security and incident response. As Joe dug deeper into security he realized where his passion resided, and that was in incident response working with the Microsoft Detection and Response Team (DART). Working in incident response has given Joe insight into SOC operations and how to help teams around the world improve their security posture within the Microsoft 365 security stack. Outside of IR, he is in constant pursuit of continued education whether that be SANS courses like the GCED or GCFA, or internal threat hunting training.
Joe Anich has 13 years of experience in the IT industry ranging from endpoint management with a focus in SCCM and Intune, to endpoint security and incident response. As Joe dug deeper into security he realized where his passion resided, and that was in incident response working with the Microsoft Detection and Response Team (DART). Working in incident response has given Joe insight into SOC operations and how to help teams around the world improve their security posture within the Microsoft 365 security stack. Outside of IR, he is in constant pursuit of continued education whether that be SANS courses like the GCED or GCFA, or internal threat hunting training.
Content
Table of Contents
Preparing for the Microsoft Exam and SC-200 Objectives
The Evolution of Security and Security Operations
Implementing Microsoft Defender for Endpoint
Implementing Microsoft Defender for Identity
Understanding and Implementing Microsoft Defender for Cloud (Microsoft Defender for Cloud Standard Tier)
An Overview: Microsoft Defender for Endpoint Alerts, Incidents, Evidence, and Dashboards
Microsoft Defender for Identity: Alerts and Incidents
Microsoft Defender for Office: Threats to Productivity
Microsoft Defender for Cloud Apps and Protecting your Cloud Apps
Setting Up and Configuring Microsoft Sentinel
Advanced Threat Hunting, Microsoft 365 Defender Portal, and Sentinel
Knowledge Check
Preparing for the Microsoft Exam and SC-200 Objectives
The Evolution of Security and Security Operations
Implementing Microsoft Defender for Endpoint
Implementing Microsoft Defender for Identity
Understanding and Implementing Microsoft Defender for Cloud (Microsoft Defender for Cloud Standard Tier)
An Overview: Microsoft Defender for Endpoint Alerts, Incidents, Evidence, and Dashboards
Microsoft Defender for Identity: Alerts and Incidents
Microsoft Defender for Office: Threats to Productivity
Microsoft Defender for Cloud Apps and Protecting your Cloud Apps
Setting Up and Configuring Microsoft Sentinel
Advanced Threat Hunting, Microsoft 365 Defender Portal, and Sentinel
Knowledge Check