SC-200 Practice Question 3673
Exam: SC-200
Domain: Manage a security operations environment
Difficulty: hard
You are configuring data retention for compliance. You need logs in a Sentinel Log Analytics workspace to be searchable via high-speed interactive KQL for 90 days, and retained in low-cost long-term storage for 7 years. How should this be configured?
Answer Options
A
Interactive Retention for 90 days and Total Retention for 2555 days (Archive tier)
B
Interactive Retention for 2555 days with no Archive tier
C
Basic logs tier with automatic 30-day deletion
D
Continuous daily export to local tape drives
Correct Answer
A: Interactive Retention for 90 days and Total Retention for 2555 days (Archive tier)
Explanation
Configure Interactive Retention (Analytics table tier) for 90 days, and set Total Retention (Archive tier) to 2555 days (7 years). Archived data remains stored cheaply and can be searched using search jobs or restore jobs.