Debug events contain unnecessary personal identifiers and dominate ingestion cost. What should be recommended before dropping those events through a supported DCR transformation?

Choose the single best answer.

A.Agree on required investigation and audit evidence, then filter or remove unnecessary fields before ingestion.
B.Drop all events during high-volume incidents using a hard cap.
C.Disable all application and resource diagnostics because the DCR covers them.
D.Assume filtered events can later be recovered from the same collection path.

Show the answer and explanation

✓ Correct answer

Agree on required investigation and audit evidence, then filter or remove unnecessary fields before ingestion.

Supported transformations reduce volume and exposure, but discarded data cannot be recovered from that collection path. Requirements must therefore be agreed first. A hard cap can remove incident evidence, and DCR collection does not replace separate application instrumentation or resource diagnostic settings. Source: AZ-305 Study Guide.pdf, PDF page(s) 10.

Read the source reference

This item is flagged for content review.

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study aid; not affiliated with or endorsed by Microsoft. Original practice questions are not real examination questions and do not guarantee an exam result.