Twenty subscriptions in one tenant share operations ownership, residency requirements, and investigation access. The team needs correlated queries at low administrative overhead. What should it recommend?

Choose the single best answer.

A.Create one workspace per subscription because cross-subscription collection is unsupported.
B.Create one workspace per VM for maximum correlation.
C.Start with a centralized workspace and add boundaries only for justified requirements.
D.Copy every record into separate operations and security workspaces without evaluating cost.

Show the answer and explanation

✓ Correct answer

Start with a centralized workspace and add boundaries only for justified requirements.

A shared workspace simplifies correlation and administration when boundaries align. Subscription count alone does not require separate workspaces. Per-VM workspaces fragment queries. Unconditional duplication can double ingestion and should be justified against isolation, access, and Sentinel requirements. Source: AZ-305 Study Guide.pdf, PDF page(s) 10.

Read the source reference

This item is flagged for content review.

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study aid; not affiliated with or endorsed by Microsoft. Original practice questions are not real examination questions and do not guarantee an exam result.