SC-200 Certification Practice Question #161

Question

You have a Microsoft Sentinel workspace that has a default data retention period of 30 days. The workspace contains two custom tables as shown in the following table.

Each table ingested two records per day during the past 365 days.

You build KQL statements for use in analytic rules as shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Accepted Answer

The pivot is that KQL analytic-rule queries read only the **interactive retention** window; the **total retention period** governs long-term/archive (data-lake) storage that is reachable solely through search/restore jobs, not KQL. Statement 1 is No because Query1 (`ago(15)`) is inside Table1's 30-day Basic interactive window, so it already returns without any plan change. Statement 2 is No because Table2 already has 365-day total retention and, regardless, raising *total* retention never changes what a KQL query returns. Statement 3 is No because Table1 (Basic) has a fixed 30-day interactive query window — changing the *total* retention period to 45 days does not make 45 days of data queryable via KQL; you would need a search job. The community is genuinely split (NNN at 17+👍 with the strongest technical justification versus NNY at 20👍), so confidence is held at 78%. MS Learn breaks the tie toward NNN: total retention is explicitly the archive tier that KQL cannot query.

More SC-200 practice questions