mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: Is required to retain audit logs for seven years…
An organization is required to retain audit logs for seven years due to regulatory compliance. The logs are currently stored on a file server that is approaching capacity. What is the BEST way to manage log storage?
⚠ Common exam trap
Candidates often confuse operational efficiency (log rotation) with long-term retention, failing to recognize that compliance mandates absolute retention periods that cannot be circumvented by deletion or reduced logging.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Compress logs and move them to low-cost archival storage.
It balances the seven-year retention requirement with storage constraints by compressing logs (reducing size) and moving them to low-cost archival storage (e.g., cold storage or tape). This preserves data integrity and accessibility for compliance audits while freeing up space on the primary file server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reduce the logging level to generate less data.
Why it's wrong here
Reducing the logging level, such as changing from 'debug' to 'error' or 'critical', significantly decreases the volume of data generated. However, this action risks omitting crucial audit information required for compliance, incident response, or forensic analysis. Organizations are often mandated to capture specific events, and lowering the logging level could lead to non-compliance with regulatory or internal audit requirements, making investigations impossible.
- ✗
Delete logs older than one year.
Why it's wrong here
Deleting logs older than one year directly violates the organization's stated seven-year retention requirement for audit logs. Such an action would result in non-compliance with regulatory mandates, internal policies, or legal obligations that necessitate long-term availability of historical audit data. This could lead to significant fines, legal repercussions, or an inability to perform historical investigations or demonstrate due diligence.
- ✗
Increase the frequency of log rotation.
Why it's wrong here
Increasing the frequency of log rotation primarily manages the size of individual active log files, preventing them from growing excessively large and consuming immediate disk space. While useful for operational management, it does not reduce the overall volume of log data generated or stored over the required seven-year retention period. Instead, it merely creates a greater number of smaller log files, which can complicate management and indexing for long-term archival purposes without addressing the fundamental storage capacity challenge.
- ✓
Compress logs and move them to low-cost archival storage.
Why this is correct
Compressing logs significantly reduces their storage footprint, making them more economical to retain over extended periods. Moving these compressed logs to low-cost archival storage, such as tape libraries, object storage, or cloud cold storage tiers, directly addresses the challenge of managing large volumes of data while meeting the seven-year retention requirement. This strategy ensures data integrity and availability for compliance and forensic needs without incurring prohibitive costs on primary storage systems.
Go deeper
Related to this question
Learn chapter
Asset Security: Privacy and Data Retention
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.