SC-200 Certification Practice Question #127

Question

You have an Azure subscription.

You plan to implement a Microsoft Sentinel workspace. You anticipate that you will ingest 20 GB of security log data per day.

You need to configure storage for the workspace. The solution must meet the following requirements:

• Minimize costs for daily ingested data. 
• Maximize the data retention period without incurring extra costs.

What should you do for each requirement? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

At only 20 GB/day, the lowest commitment tier (100 GB/day) bills for far more capacity than is used, so pay-as-you-go is the cheaper model — confirmed by MS Learn stating commitment tiers start at 100 GB/day. For retention, Sentinel retains all ingested data free for the first 90 days, with charges only beyond that, so 90 days maximizes retention without extra cost (365 days would incur charges; 31 days under-uses the free window). The highest-voted community comments and MS Learn pricing docs both align on PAYG + 90 days.

More SC-200 practice questions