SC-200 Manage a security operations environment Practice Question
Your organization is migrating to Microsoft Sentinel. You need to ensure that the workspace retains data for 2 years for compliance, but you want to reduce costs by using cheaper storage for data older than 90 days. What should you configure?
⚠ Common exam trap
Candidates often confuse Azure Storage archiving or data export with the ability to query the data in Sentinel, not realizing that only ADX provides native, queryable long-term retention integrated with Sentinel's KQL interface.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set workspace retention to 90 days and configure long-term retention in Azure Data Explorer (ADX).
Microsoft Sentinel allows you to set the workspace retention to 90 days for interactive, hot-tier access, and then configure long-term retention in Azure Data Explorer (ADX) for data older than 90 days. This approach meets the 2-year compliance requirement while reducing costs, as ADX provides cheaper storage for older data that is queried less frequently.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the workspace retention to 730 days and enable a data cap.
Why it's wrong here
Data cap does not reduce cost for retention beyond 90 days; it only limits daily ingestion.
- ✓
Set workspace retention to 90 days and configure long-term retention in Azure Data Explorer (ADX).
Why this is correct
ADX integration allows cost-effective long-term retention with query capabilities.
- ✗
Export data older than 90 days to a storage account and delete from workspace.
Why it's wrong here
Exported data cannot be queried using KQL in Sentinel.
- ✗
Configure the workspace retention to 90 days and use Azure Storage archiving.
Why it's wrong here
Archiving to Azure Storage does not preserve Log Analytics query capabilities.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 209-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.