Analytics, data lake and XDR tiers: retention, cost and table settings
Lesson coming
Workbooks and SOC optimization recommendations
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.
Question 1 · choose 1
Threat hunters need 90 days of DeviceProcessEvents in advanced hunting. A Microsoft Sentinel workspace is onboarded to the Defender portal, and the table currently has the default XDR retention. What should you do, and what does it cost?
AIngest the table only into the data lake tier; hunting then spans 90 days at no extra cost
BRaise the advanced hunting retention for Defender XDR in Settings; it's included in the license
CStream the table to an event hub; that copy appears in advanced hunting
DSet its analytics retention to 90 days; ingestion is charged, storage up to 90 days isn't
Show the answer and why
AIngest the table only into the data lake tier; hunting then spans 90 days at no extra cost
Incorrect
Data stored only in the lake isn't available in advanced hunting, and lake ingestion has its own charges.
BRaise the advanced hunting retention for Defender XDR in Settings; it's included in the license
Incorrect
Native Defender XDR data in advanced hunting is fixed at 30 days.
CStream the table to an event hub; that copy appears in advanced hunting
Incorrect
Streamed data leaves the Defender portal and isn't queried by advanced hunting.
DSet its analytics retention to 90 days; ingestion is charged, storage up to 90 days isn't
Correct
Supported XDR tables extended to 31-90 days in the analytics tier incur ingestion charges with no extra storage charge.
Defender XDR keeps hunting data for 30 days. Setting a supported XDR table's analytics retention beyond 30 days and up to 90 days ingests it into the Sentinel workspace's analytics tier (mirrored to the lake): Sentinel ingestion charges apply, storage is free up to 90 days. Data kept only in the lake is queried through data lake exploration, not advanced hunting.
Two business units share one Microsoft Sentinel workspace onboarded to the Defender portal. The EU unit's analysts must see only rows from EU firewalls in the CommonSecurityLog table, without a second workspace. Which two actions are part of the solution? (Choose TWO.)
ACreate a Sentinel scope and assign it in a unified RBAC custom role
BAssign Microsoft Sentinel Reader in Azure RBAC with a condition that limits rows to EU firewalls
CTag the table in table management so EU rows get the scope at ingestion
DRun the tagging once so that last year's EU rows become scoped
EConfigure the scope in Microsoft Sentinel in the Azure portal
Show the answer and why
ACreate a Sentinel scope and assign it in a unified RBAC custom role
Correct
Scopes are assigned only through Defender XDR unified RBAC roles.
BAssign Microsoft Sentinel Reader in Azure RBAC with a condition that limits rows to EU firewalls
Incorrect
Sentinel scopes can't be assigned through Azure RBAC on the workspace.
CTag the table in table management so EU rows get the scope at ingestion
Correct
Scope tagging creates a DCR transformation that tags newly ingested rows.
DRun the tagging once so that last year's EU rows become scoped
Incorrect
Only newly ingested data is tagged; earlier rows can't be scoped retroactively.
EConfigure the scope in Microsoft Sentinel in the Azure portal
Incorrect
Sentinel in the Azure portal doesn't support scoping.
Microsoft Sentinel scoping provides row-level RBAC in the Defender portal: create a scope, assign it in a unified RBAC custom role, and tag table rows at ingestion through table management. Only newly ingested data is tagged; earlier rows can't be scoped retroactively.
Analysts hold Microsoft Sentinel Responder on the workspace's resource group. They now need to create and save their own workbooks, but must not create or edit analytics rules. Which role do you add on the same resource group?
AMicrosoft Sentinel Contributor
BLog Analytics Contributor
CWorkbook Contributor
DMicrosoft Sentinel Reader
Show the answer and why
AMicrosoft Sentinel Contributor
Incorrect
It also lets them create and edit analytics rules and install content.
BLog Analytics Contributor
Incorrect
It grants broad workspace management rights well beyond workbooks.
CWorkbook Contributor
Correct
Creating and deleting workbooks takes a Sentinel role plus Workbook Contributor.
DMicrosoft Sentinel Reader
Incorrect
It only views Sentinel data, which Responder already covers.
The Sentinel roles table marks workbook creation as available with the Workbook Contributor role. A user with Microsoft Sentinel Responder (or another Sentinel role) plus Workbook Contributor can create and delete workbooks, which are saved in the workspace's resource group.
A SOC optimization data value recommendation flags a billable table: no analytics rule or detection used it in the last 30 days, but hunting queries and a workbook did. Which actions does the recommendation offer?
ATurn on analytics rule templates, or move the table to basic logs if eligible
BStop data ingestion and remove the table, or move the table to long-term retention instead
CMove the table to a nonsecurity Log Analytics workspace
DConnect new data sources that the active rules need
Show the answer and why
ATurn on analytics rule templates, or move the table to basic logs if eligible
Correct
This is the action set for tables used by other sources but not by detections.
BStop data ingestion and remove the table, or move the table to long-term retention instead
Incorrect
That's the action for tables not used at all in 30 days.
CMove the table to a nonsecurity Log Analytics workspace
Incorrect
That's offered when only Azure Monitor uses the table.
DConnect new data sources that the active rules need
Incorrect
That's a threat-based coverage action, not a data value one.
Data value optimizations look at billable tables that ingested data in the past 30 days. For a table used by workbooks, log or hunting queries but not by detections, the recommendation is to turn on analytics rule templates or move the table to a basic logs plan when eligible.
A Microsoft Sentinel table had 180 days of analytics retention and 180 days of total retention. To cut costs, an engineer lowered the analytics retention to 90 days and left the total retention as it was. A week later, an investigator needs the table's events from 120 days ago. What's the situation?
AThey stay in the analytics tier until the next billing month, then move
BThey're kept in the data lake tier, where KQL jobs can still reach them
CThey were deleted, because total retention follows analytics retention
DThey're still in the analytics tier, because the change applies only to new data
Show the answer and why
AThey stay in the analytics tier until the next billing month, then move
Incorrect
A change to the analytics retention of a table with existing data takes effect immediately.
BThey're kept in the data lake tier, where KQL jobs can still reach them
Correct
Data between the new analytics retention and the unchanged total retention stays in the data lake tier.
CThey were deleted, because total retention follows analytics retention
Incorrect
Total retention is a separate setting; it stayed at 180 days, so the older data isn't removed.
DThey're still in the analytics tier, because the change applies only to new data
Incorrect
The change applies to existing data at once: data older than 90 days leaves the analytics tier.
Analytics retention and total retention are separate settings. When you shorten the analytics retention of a table that already holds data, the change takes effect immediately: data older than the new analytics retention leaves the analytics tier, but data within the total retention stays in the data lake tier. There it isn't available to real-time analytics or threat hunting, but KQL jobs, scheduled jobs and notebooks can still query it.
A guest consultant from a partner company must be able to assign Microsoft Sentinel incidents to analysts. Which role combination does the guest need?
AMicrosoft Sentinel Reader only
BDirectory Reader and Microsoft Sentinel Responder
CMicrosoft Sentinel Playbook Operator
DLog Analytics Reader
Show the answer and why
AMicrosoft Sentinel Reader only
Incorrect
Reader can't manage incidents.
BDirectory Reader and Microsoft Sentinel Responder
Correct
Guests need Directory Reader, which members have by default, plus Responder.
CMicrosoft Sentinel Playbook Operator
Incorrect
It doesn't grant incident management.
DLog Analytics Reader
Incorrect
It reads workspace data but doesn't manage incidents.
For guest users to assign incidents, they need the Microsoft Entra Directory Reader role and Microsoft Sentinel Responder. Directory Reader is assigned to regular members by default but not to guests.
You connected a new data source and turned on several analytics rules. How often are SOC optimization recommendations recalculated to reflect the changes?
AEvery 15 minutes
BOnly when you select Refresh
COnce a week
DEvery 24 hours
Show the answer and why
AEvery 15 minutes
Incorrect
Recommendations aren't recalculated that often.
BOnly when you select Refresh
Incorrect
They're recalculated on a schedule.
COnce a week
Incorrect
The interval is shorter.
DEvery 24 hours
Correct
SOC optimization recommendations are calculated every 24 hours.
SOC optimization recommendations are calculated every 24 hours. If a change makes a recommendation irrelevant, the optimization is completed automatically.
Compliance requires keeping firewall logs for ten years at the lowest cost, with only the last 90 days used for detections. How do you configure the table?
AAnalytics retention of 90 days and total retention of 10 years
BAnalytics retention of 10 years
CAnalytics retention of 90 days, then export the table each quarter
DTotal retention of 90 days and a restore each year
Show the answer and why
AAnalytics retention of 90 days and total retention of 10 years
Correct
Data past the analytics retention stays in the low-cost lake for up to 12 years of total retention.
BAnalytics retention of 10 years
Incorrect
Analytics retention extends to two years at most, at a higher cost.
CAnalytics retention of 90 days, then export the table each quarter
Incorrect
Export works but isn't needed when total retention covers it.
DTotal retention of 90 days and a restore each year
Incorrect
Data past total retention is removed; there's nothing to restore.
In the analytics tier, data is fully available for real-time analytics for the analytics retention period, which can be extended up to two years. Total retention mirrors the data to the data lake and can be extended up to 12 years at a low cost.
A Microsoft Sentinel workbook on the SOC wall screen should refresh itself every 5 minutes. What do you need to know about auto refresh?
AThe shortest interval is one hour
BAuto refresh is on by default every 30 minutes
CIt's supported from 5 minutes to 1 day, and it's off by default
DIt keeps running while the workbook is in edit mode
Show the answer and why
AThe shortest interval is one hour
Incorrect
Intervals start at 5 minutes.
BAuto refresh is on by default every 30 minutes
Incorrect
Auto refresh is off by default.
CIt's supported from 5 minutes to 1 day, and it's off by default
Correct
Supported intervals range from 5 minutes to 1 day.
DIt keeps running while the workbook is in edit mode
Incorrect
Auto refresh pauses during editing.
Workbooks support auto refresh intervals from 5 minutes to 1 day. Auto refresh is off by default, pauses while you edit, and turns off again when you close the workbook.