hardMultiple ChoiceObjective-mapped
SC-100 Designing a security operations strategy Practice Question
A company is designing a security operations strategy. They want to use Microsoft Sentinel to detect and respond to threats across their hybrid environment. They need to ensure that logs from all sources are collected cost-effectively and that analysts can easily query data. Which data ingestion strategy should they recommend?
⚠ Common exam trap
Candidates often assume 'cost-effective' means using only the cheapest option (Basic logs) or only the most capable option (Analytics logs), failing to recognize that Microsoft Sentinel’s tiered ingestion model is designed specifically to optimize cost versus query capability by separating high-value and low-value log sources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Analytics logs for high-value security logs and Basic logs for verbose logs with low security value.
It balances cost and query performance by routing high-value security logs (e.g., Windows Security Events, network logs) to the Analytics logs table for full KQL query capabilities and retention, while sending verbose, low-security-value logs (e.g., DNS debug, firewall flow logs) to the Basic logs table, which offers lower ingestion cost and limited query features (e.g., no KQL summarization). This tiered approach ensures analysts can efficiently hunt on critical data without incurring unnecessary costs for voluminous, less actionable logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Send all logs to the Basic logs table to reduce costs.
Why it's wrong here
Sending all logs to the Basic logs table would reduce ingestion costs but severely limits security operations because Basic logs do not support full KQL queries or near-real-time alerting. Critical detection rules, such as those for lateral movement or data exfiltration, require advanced queries and scheduled alerts that only Analytics tables provide. Consequently, consolidating everything into Basic logs would leave the SOC blind to active threats and unable to investigate incidents effectively.
- ✗
Send only Windows Security Events to Sentinel.
Why it's wrong here
Focusing solely on Windows Security Events neglects essential telemetry from network devices, firewalls, cloud platforms, identity providers, and endpoints. An attacker often leaves traces in DNS logs, Azure Active Directory sign-ins, or cloud audit logs without generating a Windows Security Event. A robust security operations strategy requires integrating heterogeneous log sources to correlate cross-tier activity and detect multi-stage attacks, so limiting ingestion to Windows events creates dangerous blind spots.
- ✗
Send all logs to the Analytics logs table for full query capabilities.
Why it's wrong here
Sending all logs to the Analytics logs table ensures full query and alerting capability, but it is economically unsustainable at scale because verbose, low-value logs dominate storage and ingestion costs. For example, high-volume firewall flow or DNS debug logs rarely require interactive, high-performance analytical queries and can be archived in Basic logs for periodic access. A tiered approach allocates expensive Analytics storage only to logs that drive threat detection and investigations, while routing the rest to Basic logs to manage cost.
- ✓
Use Analytics logs for high-value security logs and Basic logs for verbose logs with low security value.
Why this is correct
This tiered strategy optimizes both security visibility and cost by routing high-value, actionable security logs—such as authentication failures, privilege use, and security events—to Analytics logs where they support advanced KQL queries and alert rules. Simultaneously, verbose logs with low security value, like informational audit entries or diagnostic logs, are sent to Basic logs for occasional queries and compliance. This balances operational effectiveness with budget constraints, ensuring the SOC retains critical detection and investigation capabilities without paying premium analytics costs for every byte of log data.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 208 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.