SC-200 Certification Practice Question #185

Question

You have a Microsoft Sentinel workspace named Workspace1.

The AzureActivity table in Workspace1 has the following retention periods:

•	Interactive: 180 days
•	Total: 180 days

You need to modify the retention periods to meet the following requirements:

•	Minimize the costs associated with storing data in the table.
•	Maximize the period during which the table data remains available.

How should you configure each retention period? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

Two competing goals: minimize storage cost and maximize how long data stays available. Interactive (analytics) retention is the expensive "hot" tier, but Microsoft Sentinel provides 90 days of interactive retention for free; anything below 90 (30/60) needlessly shortens free availability, and 120 days pushes past the free window into a prorated long-term retention charge — so 90 days is the cost-optimal interactive value. Total retention governs how long data is preserved in the low-cost data lake, so to maximize the availability period at minimal extra cost you pick the largest offered value, 2 years (vs. 60/90/180 days). Total retention must be ≥ interactive retention, and 2 years satisfies that. The lone discussion comment (2 👍) confirms the 90-day free interactive figure.

More SC-200 practice questions