easyMultiple Choice
CCSP Practice Question: A cloud administrator is configuring log…
A cloud administrator is configuring log retention for a financial application that must comply with PCI DSS. What is the minimum log retention period required by PCI DSS?
⚠ Common exam trap
Test-takers frequently confuse the 'immediately available' 90-day requirement with the total retention period, leading them to incorrectly select Option A instead of recognizing the full one-year retention mandate with the three-month online subset.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
At least one year with the most recent three months available online.
PCI DSS requirement 10.7 mandates that audit trail history must be retained for at least one year, with the most recent three months of logs immediately available for analysis. This ensures that historical data is preserved for forensic investigation while maintaining quick access to recent activity. Option D correctly states this dual requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
At least 90 days.
Why it's wrong here
PCI DSS requires audit logs retained for at least twelve months, with the most recent three months immediately available for analysis. Ninety days satisfies only the immediately-available window, not the full retention obligation. It would be correct if the standard demanded just a short accessible review period.
- ✗
At least six months.
Why it's wrong here
PCI DSS requires twelve months of audit log retention, with three months immediately available; six months falls short of the full year. It would be correct if the standard specified only a half-year retention window, which it does not.
- ✗
At least five years.
Why it's wrong here
PCI DSS mandates a minimum of twelve months of audit log retention, not five years. Five years exceeds the requirement and reflects other regimes or internal policy. It would be correct where sector regulation or contractual terms impose a longer preservation period than PCI DSS itself.
- ✓
At least one year with the most recent three months available online.
Why this is correct
PCI DSS requires audit trail history to be retained for at least twelve months, with the most recent three months immediately available for analysis. This satisfies the financial application's compliance constraint, so the administrator must configure retention accordingly.
Go deeper
Related to this question
About these practice questions
One of 934 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.