ExamworthyExamworthy
Open the appStart free

SC-200 - Manage a Security Operations Environment - Section 1.4

Configure the Microsoft Sentinel SIEM and platform, including roles, data retention tiers, workbooks, and SOC optimization.

Assign Microsoft Sentinel roles to control read and write access across the workspace, and choose between Analytics, Data lake, and XDR retention tiers to balance query performance against storage cost. Use Sentinel workbooks to visualise security data and apply SOC optimisation recommendations to remove gaps in coverage.

Microsoft Sentinel rolesdata retention for Analytics, Data lake, and XDR tiersMicrosoft Sentinel workbooksSOC optimization recommendations

Practice question for this objective

Free sampleManage a Security Operations Environmentmedium

Your organisation runs Microsoft Defender XDR connected to Microsoft Sentinel, and the advanced hunting tables are retained in the Microsoft Defender XDR tier for the default 30 days. A regulator now requires that the raw endpoint and identity records remain retrievable for several years for occasional audit and forensic searches, while analysts still only run high-performance interactive hunts within the recent window. You want to meet the long-term requirement at the lowest storage cost. Which approach should you take?

  • AExtend the Microsoft Defender XDR tier retention setting itself to the multi-year period so the advanced hunting tables hold the full history in their default tier
  • BRaise the interactive retention on each advanced hunting table to the multi-year period so the records stay queryable at high performance for the full duration
  • CConfigure a summary rule that aggregates the advanced hunting tables into a compact table and keep only those summarised rows for the multi-year period
  • DExtend total retention so the records move into the Microsoft Sentinel data lake tier for long-term low-cost storage once the default tier period ends Correct
Extending total retention moves data into the low-cost Microsoft Sentinel data lake tier for years of retrievable storage, while interactive and XDR-tier retention serve recent hunting. The Defender XDR tier and interactive retention keep data in the high-performance hot state for recent hunting and cap out below multi-year needs at high cost. Total retention extends storage into the data lake tier, where records remain retrievable for batch audit and forensic searches at a low per-gigabyte cost, which fits occasional multi-year access without paying to keep every raw row hot.

Why A is wrong: The Defender XDR default tier serves recent high-performance hunting and is not the lever for cheap multi-year storage, so relying on it alone does not deliver the low-cost long-term retention required.

Why B is wrong: Extending interactive retention keeps data in the costly hot tier and is capped well below several years, so it inflates storage spend rather than minimising it for occasional audit searches.

Why C is wrong: Summary rules pre-compute aggregates and are useful for trend reporting, but they discard the raw per-record detail the regulator requires, so audit and forensic searches against original rows would fail.

Why D is correct: Extending total retention rolls the records into the low-cost data lake tier after the hot period, keeping them retrievable for years for batch audit searches at the lowest storage cost while recent interactive hunting is unaffected.

See more SC-200 practice questions, answers explained.

More in this domain

Back to all Manage a Security Operations Environment objectives, or the SC-200 cert hub.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.