During an incident, telemetry spikes and a daily ingestion cap stops collecting logs. Which design improvement best preserves incident evidence while controlling cost?

Choose the single best answer.

A.Disable all monitoring during high-error periods.
B.Reduce unnecessary source volume and use supported transformations with agreed evidence requirements.
C.Assume the workspace will reconstruct discarded logs later.
D.Lower the cap further to make the incident cheaper.

Show the answer and explanation

✓ Correct answer

Reduce unnecessary source volume and use supported transformations with agreed evidence requirements.

Controlling unnecessary sources and transforming supported streams can reduce cost while preserving essential signals. A lower cap or disabling monitoring worsens the evidence gap. Logs discarded or never ingested through that path cannot be reconstructed from the workspace. Source: AZ-305 Study Guide.pdf, PDF page(s) 11.

Read the source reference

This item is flagged for content review.

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study aid; not affiliated with or endorsed by Microsoft. Original practice questions are not real examination questions and do not guarantee an exam result.