Crucial Exams

Microsoft Security Operations Analyst Associate SC-200 Practice Question

Your SOC ingests high-volume Syslog data into an Azure Log Analytics workspace that is connected to Microsoft Sentinel. Analysts must be able to run interactive KQL queries on the data for 180 days. Compliance rules also require keeping the same data for a total of 13 months at the lowest possible cost, but the data does not have to remain immediately searchable after the first 180 days. Which configuration should you implement in the workspace to meet both requirements at minimal cost?

  • Enable continuous data export to an Event Hub and delete the data from the workspace after 180 days to reduce cost.

  • Create a diagnostic setting that exports the Syslog data to an Azure Storage account configured with a 13-month lifecycle policy.

  • Set a per-table policy that retains the Syslog table in the analytics tier for 180 days and then archives it for an additional 215 days.

  • Move the Syslog table to Basic Logs and rely on its 30-day interactive retention while keeping data for 13 months.

Microsoft Security Operations Analyst Associate SC-200
Manage a security operations environment
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot