SC-200 Basic Logs Practice Question
You are designing a Microsoft Sentinel deployment. You need to minimize ingestion costs while ensuring that all security-relevant events are collected. Which strategy should you use?
⚠ Common exam trap
SC-200 often tests the assumption that all logs must be Analytic for full security coverage — candidates miss that Basic Logs still collect data and can be queried, just with limitations, making them ideal for verbose sources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Basic Logs for verbose data sources like Windows firewall logs, and Analytic Logs for high-value security logs
Microsoft Sentinel offers two log plan tiers: Analytic Logs (full KQL, alerts, workbooks) and Basic Logs (cheaper ingestion, limited query, 30-day retention). Placing high-volume, low-value sources like Windows firewall logs in Basic Logs and reserving Analytic Logs for high-value security events minimizes cost while still collecting all relevant data. This is the documented cost-optimization pattern.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Analytic Logs for all data sources to ensure full query capabilities
Why it's wrong here
Analytic Logs retain full KQL query capability but bill at the higher Analytics tier rate, so applying them to every source inflates ingestion cost rather than minimising it. The tier suits sources needing frequent scheduled analytics rules and incident generation; Basic Logs would be the right choice for high-volume, low-value data queried only occasionally.
- ✓
Use Basic Logs for verbose data sources like Windows firewall logs, and Analytic Logs for high-value security logs
Why this is correct
Basic Logs cost less per gigabyte but support only limited querying, so routing verbose, low-value sources such as firewall logs there cuts spend. Analytic Logs retain full KQL and analytics-rule support for high-value security events, meeting both cost and detection requirements.
- ✗
Set short retention periods for all logs and export to storage
Why it's wrong here
Shortening retention does not reduce ingestion charges, which accrue when data enters the workspace; the stem asks to minimise ingestion while collecting all security-relevant events. Exporting to storage addresses long-term retention cost, not ingestion volume. This would suit a scenario needing cheap archival of already-ingested data beyond Sentinel's retention window.
- ✗
Collect only logs from Microsoft 365 Defender and ignore other sources
Why it's wrong here
Collecting only Microsoft 365 Defender logs leaves endpoint, identity and network telemetry uncollected, so the requirement that all security-relevant events be gathered fails. It is tempting because Defender connectors are free and simple, and would suit a scope deliberately limited to Microsoft 365 workloads rather than enterprise-wide Sentinel ingestion.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 1,303 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.