Dedicated Cluster: Spanning Azure Workspaces in Multiple Regions

Correct Answer: B Option B is correct.

All workspaces linked to a cluster must be in the same region.

Reference:

The statement "A dedicated cluster can span workspaces in multiple Azure regions" is false.

In Azure Sentinel, a dedicated cluster is a set of machines that are used exclusively for processing data in a single workspace. Each workspace is associated with a specific Azure region, and data is stored in that region. Therefore, it is not possible for a dedicated cluster to span workspaces in multiple Azure regions.

If an organization needs to process data from multiple regions, they can either create multiple workspaces and dedicate a cluster to each workspace, or they can use a single workspace with multiple data connectors to collect data from multiple regions. In either case, each workspace and its associated dedicated cluster will be confined to a single Azure region.

It's worth noting that while a dedicated cluster cannot span multiple regions, Azure Sentinel does provide cross-workspace query functionality, allowing users to query data from multiple workspaces. However, this functionality does not involve a single dedicated cluster processing data from multiple regions.