You have a Microsoft Sentinel workspace that contains the following tables. You need to investigate the log data by using a search. Which tables can you search?

The correct answer is D. Table1, Table3, and Table4 only. Table1 - Yes, Table2 - No Basic Plan: Data is interactive for 30 days at a lower cost, optimized for single-table queries (troubleshooting/incidents). Table3 - Yes, Table4 - Yes Analytics Plan: Data is interactive for 4-730 days (default 30-90 days), ideal for real-time…

Submitted by wei.xz· Apr 18, 2026

Question

Exhibit

Options

ATable3 only
BTable1 and Table3 only
CTable3 and Table4 only
DTable1, Table3, and Table4 only
ETable1, Table2, Table3, and Table4

How the community answered

(57 responses)

A
2% (1)
B
7% (4)
C
11% (6)
D
79% (45)
E
2% (1)

Explanation

Table1 - Yes, Table2 - No Basic Plan: Data is interactive for 30 days at a lower cost, optimized for single-table queries (troubleshooting/incidents). * Table3 - Yes, Table4 - Yes Analytics Plan: Data is interactive for 4-730 days (default 30-90 days), ideal for real-time analytics, with full KQL support. https://learn.microsoft.com/en-us/azure/azure-monitor/logs/search-jobs

Community Discussion

No community discussion yet for this question.

Full SC-200 Practice