Study. uk . com
  1. Home
  2. All questions
  3. Question 516

CompTIA Security+ study material · question 516 of 611

Why should log retention be planned against investigation needs rather than storage cost alone?

  1. Because normalisation requires historical data
  2. Because regulators require seven years in all cases
  3. Because logs cannot be compressed
  4. Because intrusions are often discovered months after they began
Show the answer

Answer: D. Because intrusions are often discovered months after they began

If the retention window is shorter than the dwell time, the evidence of the initial access is already gone.

Source: NIST SP 800-92 (NIST) — SP 800-92 § 2 Introduction to Computer Security Log Management

Challenge yourself on this topic → Study as cards