Design solutions that align with security best practices and priorities →hardMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design solutions that align with security best practices and priorities
A security team is designing a Microsoft Sentinel deployment. They need to minimize costs while ensuring critical alerts are always processed. Which data retention and ingestion strategy should they use?
⚠ Common exam trap
Watch out — candidates often assume all data must be in Analytics Logs for security monitoring, overlooking the cost-saving strategy of tiered ingestion where Basic Logs handle high-volume, low-value data without sacrificing critical alert processing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Basic Logs for high-volume low-value data and Analytics Logs for critical alerts
It aligns with cost optimization and reliability requirements by using Basic Logs for high-volume, low-value data (e.g., firewall logs) and reserving Analytics Logs for critical alerts that require full query capabilities and interactive retention. This tiered approach ensures critical alerts are always processed with full fidelity while reducing storage costs for less important data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Basic Logs for all data and retain for 90 days
Why it's wrong here
Basic Logs is a lower-cost ingestion tier for Log Analytics workspaces, but it has a hard, non-negotiable maximum retention of 30 days. There is no supported mechanism to extend Basic Logs retention to 90 days—whether through workspace settings, data export rules, or retention policies—so this configuration is technically impossible. Even if retention were sufficient, Basic Logs only supports simple text search rather than full KQL analytics, which would cripple security investigations if all data landed there. Thus, ignoring the retention cap alone invalidates this option.
- ✗
Use Analytics Logs for all data and retain for 30 days
Why it's wrong here
Analytics Logs provide full KQL query capability, near-real-time alerting, and up to two years of interactive retention, but they carry a significantly higher per-GB ingestion and storage price. In a high-volume, security-centric deployment, sending every Syslog, NetFlow, and Windows event stream to the Analytics tier would quickly exhaust cost budgets without proportional security value. The question explicitly requires cost minimization while maintaining effective monitoring, so blanket use of the most expensive tier for all data contradicts that goal. A cost-balanced design must reserve Analytics Logs for data that needs frequent querying or alerting, not for bulk verbose logs.
- ✗
Use Basic Logs for critical alerts and retain for 30 days
Why it's wrong here
Basic Logs are explicitly designed for data that is rarely queried and do not support the full analytical feature set required for critical security alerts: they lack KQL operators, real-time alerting transitions, and deep investigation experiences like bookmarks and hunting. Critical alert data must be available for immediate incident response, threat hunting, and compliance reporting, which demands the low-latency and advanced query capabilities of Analytics Logs with retention beyond 30 days. Moreover, Basic Logs' 30-day retention ceiling is insufficient for forensic investigations that often span months. Placing high-value alerts in this tier sacrifices both performance and long-term access, making it operationally dangerous despite any upfront cost savings.
- ✓
Use Basic Logs for high-volume low-value data and Analytics Logs for critical alerts
Why this is correct
This is the correct cost-performance trade-off: route high-volume, low-value data such as verbose firewall logs, debug traces, and raw DNS events to Basic Logs to slash ingestion costs, while steering critical security alerts and curated detection data into Analytics Logs for full KQL querying, alerting, and hunting workflows. Basic Logs' lower cost and acceptable simple-search capability align perfectly with data that is retained mainly for compliance or ad-hoc troubleshooting, while Analytics Logs' rich analytical features and long retention match the needs of high-priority security detections. Microsoft Sentinel supports this pattern natively by configuring table-level plans, enabling a single workspace to hold both tiers and ensuring that analysts can query the data that matters most with low latency. This balanced design meets both cost optimization and security operational requirements, making it the only viable answer.
Go deeper
Related to this question
About these practice questions
One of 208 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.