問題文
Why does an analyst need to know which log types are being forwarded to the central store before starting an investigation?
選択肢
- Because the store converts every type into a single common format so that the original type of a record can no longer be told apart once it has been ingested into the service.
- Because the retention period is set per query so a query that reaches too far back returns fewer records than one that covers a shorter span of the same period.
- Because the query language differs for each type so an analyst who starts with the wrong syntax gets an empty result that looks the same as a genuine absence.
- Because a type that was never forwarded cannot be queried there, so its absence in the results says nothing about whether the event occurred.