SC-200 Manage a security operations environment Practice Question
Your organization uses Microsoft Sentinel and you are designing a data retention strategy. You have a Log Analytics workspace with the following tables: SecurityEvent, SigninLogs, and CommonSecurityLog. The compliance team requires that SigninLogs be retained for 7 years, while other tables can be retained for 1 year. Which THREE steps must you take to meet this requirement?
⚠ Common exam trap
Many exam-takers think archiving (Option A) or external services like ADX (Option C) are required for long-term retention, when in fact Log Analytics supports up to 7 years of native retention with table-level granularity, making workspace and table-level settings the correct combination.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the workspace retention to 7 years.
Setting the workspace retention to 7 years ensures that all tables in the workspace, including SigninLogs, are retained for the maximum required period. However, this alone would also retain other tables longer than needed, so you must combine it with table-level retention to override the workspace setting for specific tables. This approach allows you to meet the 7-year compliance requirement for SigninLogs while keeping other tables at 1 year.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set an archiving policy to move SigninLogs to cold storage after 1 year.
Why it's wrong here
Archiving policy moves data to long-term storage but is not necessary if retention is set to 7 years.
- ✓
Set the workspace retention to 7 years.
Why this is correct
Setting the Log Analytics workspace retention to 7 years ensures that all tables, including SigninLogs, will initially meet the 7-year retention requirement for Microsoft Entra ID sign-in data. This is crucial because individual table retention settings can only reduce, not extend, the overall workspace retention period. Therefore, this step establishes the necessary ceiling, allowing SecurityEvent and CommonSecurityLog tables to be subsequently configured with a 1-year retention, overriding the workspace default downwards.
- ✗
Enable Azure Data Explorer (ADX) for long-term storage.
Why it's wrong here
ADX is not required; table-level retention within Log Analytics is sufficient.
- ✓
Configure table-level retention for SigninLogs to 7 years.
Why this is correct
Table-level retention allows specific tables to have longer retention.
- ✓
Ensure that the workspace is in a region that supports 7-year retention.
Why this is correct
Some regions may have retention limits; you need to verify compliance.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your Microsoft Sentinel workspace is ingesting data from multiple sources. You need to ensure that data from a specific source is retained for 2 years while other data remains at the default retention. What should you do?
easy- ✓ A.Create a custom table for that source and set its retention to 2 years.
- B.Adjust the data ingestion settings for that source.
- C.Set the workspace retention to 2 years.
- D.Configure archiving for that source's data.
Why A: In Microsoft Sentinel, retention is set at the table level. By creating a custom table for the specific data source and configuring its retention period to 2 years, you can override the default workspace retention for that table only. This allows other tables to retain the default retention setting while the custom table retains data for the required duration.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.