ExpertAZ-305 · Question 03 · Domain 1.1: Logging and Monitoring
You are designing a security monitoring solution using Microsoft Sentinel.
The compliance department requires that all security incident data and associated logs be retained for exactly 7 years. The data must be available for interactive querying for the first 90 days, and afterward, it must be retained at the lowest possible cost while still being accessible for compliance audits within 48 hours if requested.
Which data retention strategy should you configure in the Log Analytics workspace?
You are designing a security monitoring solution using Microsoft Sentinel.
The compliance department requires that all security incident data and associated logs be retained for exactly 7 years. The data must be available for interactive querying for the first 90 days, and afterward, it must be retained at the lowest possible cost while still being accessible for compliance audits within 48 hours if requested.
Which data retention strategy should you configure in the Log Analytics workspace?
Answer options:
Set the workspace retention to 7 years.
Set the workspace retention to 90 days and export logs to an Azure Storage account with a lifecycle policy moving data to the Archive tier.
Set the workspace retention to 90 days and configure Archive tier retention for up to 7 years.
Configure a Data Collection Rule to route data older than 90 days to Azure Data Explorer.
How to approach this question
Full Answer
Common mistakes
Practice the full Azure Solutions Architect Expert AZ-305 Practice Exam 2
55 questions · hints · full answers · grading