A security architect is reviewing the disaster recovery plan for an AI security monitoring system built on Microsoft Sentinel. The Sentinel workspace is in the East US region. If East US becomes unavailable, the team needs to continue ingesting AI security alerts. Which Sentinel feature supports this requirement?

The correct choice is deploying a second Microsoft Sentinel workspace in West US and using Azure Event Hub to dual-ingest alerts to both workspaces. Microsoft Sentinel's high availability and disaster recovery approach involves deploying a secondary Sentinel workspace in an alternate region and configuring data sources, such as Defender for AI alerts, to send data to Azure Event Hub, which can be consumed by both the primary and secondary Sentinel workspaces simultaneously. This ensures continued alert ingestion during a regional outage. The choice proposing Sentinel workspace replication to a secondary Log Analytics workspace in West US is incorrect because Microsoft Sentinel does not natively support workspace replication to a secondary workspace; data must be sent to both independently. The choice proposing cross-workspace queries spanning East US and West US workspaces is incorrect because cross-workspace queries allow querying across multiple workspaces but do not provide redundant ingestion; if East US is down, the primary workspace ingestion stops regardless of cross-workspace query capability. The choice proposing Geo-redundant storage on the Log Analytics workspace underlying Microsoft Sentinel is incorrect because Geo-redundant storage provides data durability, with data replicated for disaster recovery, but does not provide active-active ingestion or failover to a secondary workspace for operational continuity.