AZ-305 · Question 03 · Domain 1.1: Logging and Monitoring
Your company uses Microsoft Sentinel integrated with a Log Analytics workspace. The workspace ingests 500 GB of data daily.
You are tasked with optimizing costs. You notice that 300 GB of the daily ingestion consists of network firewall flow logs. These logs are rarely queried for active threat hunting but must be retained for 3 years for compliance audits. When they are needed for audits, a query response time of up to 24 hours is acceptable.
Which cost optimization strategy should you recommend for the firewall logs?
Answer options:
Move the workspace to a Capacity Reservation tier of 500 GB/day.
Configure the firewall log tables to use the Basic Logs data plan and configure a Search Job when data is needed.
Export the logs to an Azure Storage account using the Archive tier and delete them from Log Analytics.
Configure a Data Collection Rule (DCR) to filter out the firewall logs before ingestion.
55 questions · hints · full answers · grading
Expert