SC-200 Practice Question: A SOC analyst is configuring a multi-region…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Step 1: Create Log Analytics workspaces in each region. Step 2: Enable Sentinel on each workspace. Step 3: Connect data sources. Step 4: Configure cross-workspace queries.

  Why this is correct

  This sequence is correct because Microsoft Sentinel is built on top of a Log Analytics workspace; the workspace must be provisioned before Sentinel can be enabled. Enabling Sentinel on each regional workspace first ensures that the data connectors have a valid destination and can immediately begin ingesting and normalizing logs. Once all regional workspaces have Sentinel active, you can configure cross-workspace queries to unify monitoring while preserving data residency, which is the recommended pattern for multi-region deployments.

• ✗

  Step 1: Enable Sentinel in one region. Step 2: Create workspaces in other regions. Step 3: Connect data sources. Step 4: Configure cross-workspace queries.

  Why it's wrong here

  This order fails because you cannot enable Microsoft Sentinel without first having a Log Analytics workspace to host it—Sentinel is a solution that attaches to an existing workspace. Even if you enabled Sentinel in one region, the other regions would still not have workspaces or Sentinel, meaning you would have to repeat the enable step after creating them. Additionally, the single Sentinel instance cannot ingest data from regional workspaces that do not exist yet, so the sequence is technically invalid from the start.

• ✗

  Step 1: Connect data sources. Step 2: Create workspaces. Step 3: Enable Sentinel. Step 4: Configure cross-workspace queries.

  Why it's wrong here

  Connecting data sources before creating any Log Analytics workspace is technically impossible because the data connectors require an existing workspace as the storage and indexing destination. A Log Analytics workspace must first be created, and Sentinel should be enabled on that workspace before you configure connectors to collect security logs. Attempting to connect sources first would fail because there is no workspace resource to receive and retain the telemetry, making this sequence non-functional.

• ✗

  Step 1: Create a central workspace. Step 2: Enable Sentinel on it. Step 3: Connect data sources from all regions to the central workspace. Step 4: Configure cross-workspace queries.

  Why it's wrong here

  This approach contradicts the recommended multi-region deployment pattern. While a single central workspace can technically receive logs from all regions, doing so forces data to leave its region of origin, potentially violating data residency requirements and introducing latency and egress costs. The correct architecture is to keep data in the workspace of the region where it is generated, then use cross-workspace queries to correlate and investigate incidents without physically centralizing the data.

Go deeper

Related to this question