AZ-305 Practice Question 3: Log Retention Cost Design
Microsoft Azure Solutions Architect Expert (AZ-305) · Test 1 · question 3 of 10
A security operations team collects the SigninLogs table into a Log Analytics workspace. Analysts run interactive KQL queries against roughly the last 30 days of data. An auditor requires that the same sign-in records remain retrievable for seven years, but expects to request them only two or three times a year during investigations.
Which retention design meets both requirements at the lowest cost?
Show answer and explanation
Answer:
A Log Analytics table holds data in two states. Analytics retention keeps data available for real-time queries and is billed at the higher rate; anything beyond it, up to a total retention of 12 years, sits in the low-cost long-term retention state. Data in long-term retention is still in the same table and is recovered with a search job. Matching analytics retention to the 30 days analysts actually query, while setting total retention to seven years, is exactly the pattern this scenario calls for.
Option A is not possible as written and would be expensive if it were. Analytics retention for Analytics-plan tables can be extended only to 730 days (two years), so 2,555 days cannot be set as analytics retention, and paying the analytics rate for years of rarely touched data is the most expensive option available.
Option B works technically but adds a second platform to size, secure, and pay for. Long-term retention already provides seven-year storage inside the workspace with no extra service.
Option C loses fidelity and adds operational burden. A daily query export produces flat files without the table schema, needs custom code to keep running for seven years, and gives auditors no query surface. The platform feature does the same job with no code.
Reference: Manage data retention in a Log Analytics workspace