SC-200 Manage a security operations environment Practice Question
Which TWO actions should you take to optimize cost in Microsoft Sentinel while maintaining security coverage? (Choose two.)
⚠ Common exam trap
Test-takers frequently confuse 'commitment tiers' (which reduce per-GB cost) with a direct cost-optimization action, but the question asks for specific actions you take, not pricing models; also, 'continuous export' sounds like a way to offload data, but it actually adds cost and complexity unless used for a specific purpose.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Adjust the interactive retention period for tables that don't need long-term interactive access.
Reducing interactive retention for tables that do not require long-term, fast query access directly lowers storage costs. Microsoft Sentinel charges per GB for data stored in the interactive retention tier, while data moved to long-term retention (up to 12 years) is significantly cheaper. By tailoring retention periods to actual operational needs, you avoid paying premium rates for data that is rarely queried interactively.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable continuous export for all tables.
Why it's wrong here
Enabling continuous export for all tables incurs additional data processing and storage costs because every ingested record is continuously copied to an Azure Storage destination. Continuous export is a feature designed for long-term retention or integration with other systems, not for reducing operational cost. Therefore, this action increases your total Log Analytics expenditure rather than optimizing it.
- ✗
Purchase a Pay-as-you-go commitment tier.
Why it's wrong here
Purchasing a Pay-as-you-go commitment tier is not a direct cost-optimization action; a commitment tier, such as that for Log Analytics capacity reservations, requires you to commit to a specific daily data volume in advance. While it can lower the per-GB price, it does not reduce your actual data volume or change how tables are configured, and the 'Pay-as-you-go' label specifically implies no commitment. For immediate and flexible cost savings, you would instead adjust retention periods or switch to Basic Logs.
- ✓
Adjust the interactive retention period for tables that don't need long-term interactive access.
Why this is correct
Correct. Adjusting the interactive retention period lets you move data out of the expensive, fast-query interactive tier into lower-cost long-term retention or archive after a short time. For tables that rarely need immediate access or advanced analytics, shortening this period directly reduces your monthly storage cost without losing the ability to retrieve older data later. This is a table-level cost-control technique that aligns storage spending with actual query needs.
- ✗
Add more tables to ingest data.
Why it's wrong here
Adding more tables to ingest data increases your data-ingestion cost because each additional table typically receives duplicated or separate log streams, and you pay per GB for every record ingested into Log Analytics. This also fragments your query environment and may require additional data-collection rules, adding management overhead rather than reducing spend. It is not a cost optimization strategy in any sense.
- ✓
Use Basic Logs for high-volume, low-value data sources.
Why this is correct
Basic Logs is a lower-cost ingestion tier in Azure Log Analytics designed for high-volume, verbose, and low-value data sources such as debug logs, network flows, or telemetry that do not require full query capabilities or frequent interactive analysis. Ingesting such data into Basic Logs costs significantly less per GB than Analytics Logs, and it automatically enforces a shorter retention period. Choosing this tier for appropriate tables directly reduces the cost of telemetry collection.
Go deeper
Related to this question
About these practice questions
One of 1,303 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.