You manage 200 Windows and Linux VMs across three regions. Requirements: 1) Security and operations teams need role-based access to logs per region, yet you require the ability to run centralized queries across all VMs. 2) Retain SecurityEvent for 180 days but keep performance counters (Perf) only 30 days. 3) Collect only specific Windows event IDs and filter noisy data at collection time. What workspace and data collection design should you recommend?

This option correctly addresses all requirements. Deploying one Log Analytics workspace per region allows for regional RBAC, while cross-workspace KQL queries enable centralized reporting. The Azure Monitor Agent (AMA) with Data Collection Rules (DCRs) supports data transformations, allowing filtering of specific Windows event IDs and reducing noisy data at collection time. Per-table retention satisfies the different retention periods for SecurityEvent (180 days) and Perf (30 days). Incorrect options: A single global workspace prevents regional RBAC. The legacy MMA agent is being deprecated, and workspace-level retention cannot meet per-table requirements. One workspace per application team doesn't align with regional RBAC needs. Collecting all events without DCRs is inefficient and costly. Exporting to ADLS Gen2 for reporting adds complexity. Sending logs directly to Event Hubs and then to a central workspace adds unnecessary complexity and latency, and doesn't directly support the specified retention or filtering requirements within Log Analytics. Using Azure Sentinel workspaces per region is an option for security, but the uniform 90-day retention does not meet the specific 180-day and 30-day requirements. Not filtering at ingestion is inefficient.