A security architect is reviewing the disaster recovery plan for an AI security monitoring system built on Microsoft Sentinel. The Sentinel workspace is in the East US region. If East US becomes unavailable, the team needs to continue ingesting AI security alerts. Which Sentinel feature supports this requirement?

C is correct because Microsoft Sentinel's high availability and disaster recovery approach involves deploying a secondary Sentinel workspace in an alternate region and configuring data sources (like Defender for AI alerts) to send data to Azure Event Hub, which can be consumed by both the primary and secondary Sentinel workspaces simultaneously. This ensures continued alert ingestion during a regional outage. A is incorrect because Microsoft Sentinel does not natively support workspace replication to a secondary workspace; data must be sent to both independently. B is incorrect because cross-workspace queries allow querying across multiple workspaces but do not provide redundant ingestion; if East US is down, the primary workspace ingestion stops regardless of cross-workspace query capability. D is incorrect because Geo-redundant storage on the Log Analytics workspace provides data durability (data is replicated for disaster recovery) but does not provide active-active ingestion or failover to a secondary workspace for operational continuity.