Exam Ref SC-200 Microsoft Security Operations Analyst

Sarah Young is a cyber security advocate working at Microsoft who engages with individuals and organizations worldwide to share her knowledge and experience in cyber security. As a cloud security expert, Sarah's mission is to educate and empower communities to do the right things securely with the technology they implement. She has also authored white papers and books on various cyber security topics and is a co-host of the popular Microsoft Azure Security Podcast.Sarah is an accomplished public speaker and has delivered presentations at various industry events including Black Hat. She is passionate about supporting the security communities across the globe and promoting diversity and inclusion in IT.

• IntroductionModule 1: Implement Information Protection Lesson 1: Implement and Manage Data Classification1.1 Identify sensitive information requirements for an organization’s data1.2 Translate requirements into built-in or custom sensitive info types1.3 Create and manage custom sensitive info types1.4 Implement document fingerprinting1.5 Create and manage exact data match (EDM) classifiers1.6 Create and manage trainable classifiers1.7 Monitor classification with data explorer and content explorer1.8 Configure optical character recognition (OCR) support for sensitive info typesLesson 2: Implement and Manage Sensitivity Labels in Microsoft Purview2.1 Implement roles and permissions for sensitivity labels2.2 Define and create sensitivity labels for items and containers2.3 Configure protection settings and content marking for sensitivity labels2.4 Configure and manage publishing policies for sensitivity labels2.5 Configure and manage auto-labeling policies for sensitivity labels2.6 Apply sensitivity labels to containers, such as Microsoft Teams, Microsoft 365 Groups, Microsoft Power BI, and Microsoft SharePoint2.7 Apply sensitivity labels by using Defender for Cloud AppsLesson 3: Implement Information Protection for Windows, File Shares, and Exchange3.1 Implement protection for Windows, file shares, and Exchange3.2 Plan and implement the Purview Information Protection client3.3 Manage files using the Purview client3.4 Apply bulk classification to on-premises data by using the Microsoft Purview Information Protection scanner3.5 Design and implement Microsoft Purview Message Encryption3.6 Design and implement Microsoft Purview Advanced Message EncryptionModule 2: Implement Data Loss Prevention and Retention Lesson 4: Create and Configure Data Loss Prevention (DLP) Policies 4.1 Design DLP policies based on an organization’s requirements4.2 Implement roles and permissions for DLP4.3 Create and manage DLP policies4.4 Configure DLP policies for Adaptive Protection4.5 Interpret policy and rule precedence in DLP4.6 Create file policies in Microsoft Defender for Cloud Apps by using a DLP policyLesson 5: Implement and Monitor Microsoft Purview Endpoint DLP5.1 Specify device requirements for Endpoint DLP, including extensions5.2 Configure advanced DLP rules for devices in DLP policies5.3 Configure Endpoint DLP settings5.4 Configure just-in-time protection5.5 Monitor endpoint activitiesLesson 6: Implement and Manage Retention6.1 Plan for information retention and disposition by using retention labels6.2 Create, configure, and manage adaptive scopes6.3 Create retention labels for data lifecycle management6.4 Configure retention label policies (publish/auto-apply)6.5 Interpret the results of policy precedence, including using Policy lookup6.6 Create and configure retention policies6.7 Recover retained content in Microsoft 365Module 3: Manage Risks, Alerts, and Activities Lesson 7: Implement and Manage Microsoft Purview Insider Risk Management7.1 Implement roles and permissions for Insider Risk Management7.2 Plan and implement Insider Risk Management connectors7.3 Plan and implement integration with Microsoft Defender for Endpoint7.4 Configure and manage Insider Risk Management settings7.5 Configure policy indicators7.6 Select an appropriate policy template7.7 Create and manage Insider Risk Management policies7.8 Manage forensic evidence settings7.9 Enable and configure insider risk levels for Adaptive Protection7.10 Manage insider risk alerts and cases7.11 Manage Insider Risk Management workflow, including notice templatesLesson 8: Manage Information Security Alerts and Activities8.1 Assign Microsoft Purview Audit (Premium) user licenses8.2 Investigate activities by using Microsoft Purview Audit8.3 Configure audit retention policies8.4 Analyze Purview activities by using activity explorer8.5 Respond to data loss prevention alerts in the Microsoft Purview portal8.6 Investigate insider risk activities by using the Microsoft Purview portal8.7 Respond to Purview alerts in Microsoft Defender XDR8.8 Respond to Defender for Cloud Apps file policy alerts8.9 Perform searches by using Content searchLesson 9: Protect Data Used by AI Services9.1 Implement controls in Microsoft Purview to protect content in an environment that uses AI services9.2 Implement controls in Microsoft 365 workloads to protect content in an environment that uses AI services9.3 Implement prerequisites for Data Security Posture Management (DSPM) for AI9.4 Manage roles and permissions for DSPM for AI9.5 Configure DSPM for AI policies9.6 Monitor activities in DSPM for AI