ISC2 CC Security Operations Practice Question
An organization must retain authentication logs for compliance with PCI DSS. What is the minimum retention period and the requirement for immediate availability?
⚠ Common exam trap
The trap is that candidates may recall a different retention figure (e.g., HIPAA's 6 years or SOX's 7 years) or confuse the retention period with the immediately-available window, leading them to pick an option that swaps or inflates the numbers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
12 months retention with 3 months immediately available
PCI DSS Requirement 10.7 mandates retaining audit logs for at least 12 months, with a minimum of the most recent 3 months immediately available for analysis. This ensures organizations can investigate recent incidents quickly while still preserving a full year of history for forensic and compliance review.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
6 months retention with 1 month immediately available
Why it's wrong here
PCI DSS mandates twelve months of retention, with the last three months immediately available for analysis; six months with one month available satisfies neither figure. Six months would suffice only under a framework specifying a shorter retention window.
- ✗
24 months retention with 12 months immediately available
Why it's wrong here
PCI DSS mandates 12 months of log retention with only the last 3 months immediately available, so 24 months and 12 months available both exceed the requirement. It tempts because extended retention sounds more compliant, but the standard fixes 12 months total and 3 months immediately accessible.
- ✗
18 months retention with 6 months immediately available
Why it's wrong here
PCI DSS requires 12 months of retention with the most recent 3 months immediately available, so 18 months overstates the retention period and misstates the availability window. It tempts because longer retention appears safer for audits, yet the standard specifies 12 months total, not 18.
- ✓
12 months retention with 3 months immediately available
Why this is correct
PCI DSS mandates retaining audit trail history for at least twelve months, with the most recent three months immediately available for analysis. This satisfies both constraints in the stem: the minimum retention period and the immediate-availability requirement for authentication logs.
Go deeper
Related to this question
Learn chapter
Authentication and Authorization Methods
Key term
PCI DSS
The Payment Card Industry Data Security Standard is a set of security requirements designed to protect credit card data during storage, processing, and transmission.
Key term
Payment Card Industry Data Security Standards
A set of security rules that any company that handles credit card payments must follow to protect cardholder data from theft and fraud.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.