SC-100 Practice Question 3907
Exam: SC-100
Domain: Design security operations, identity, and compliance capabilities
Difficulty: medium
You are designing a centralized logging topology for Microsoft Sentinel across 20 Azure subscriptions in three geographic regions. Which workspace architecture is recommended by Microsoft for cost and operational efficiency unless regulatory boundaries dictate otherwise?
Answer Options
A
A single centralized Log Analytics workspace
B
A separate workspace for every virtual machine in Azure
C
A temporary workspace recreated every morning at 8 AM
D
Saving logs to text files on an on-premises file share
Correct Answer
A: A single centralized Log Analytics workspace
Explanation
A single, centralized Log Analytics workspace is recommended to eliminate data fragmentation, avoid cross-workspace query latency, simplify RBAC management, and maximize ingestion commitment tier discounts.