CISSP Security Assessment and Testing Practice Question
An organization is required to retain security logs for a minimum of one year to meet compliance regulations. Which practice is most directly related to this requirement?
⚠ Common exam trap
Candidates often confuse 'log retention requirements' with 'centralized log management,' thinking that centralization inherently includes retention, but retention is a separate policy that must be explicitly defined and configured regardless of where logs are stored.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Log retention requirements
The requirement to retain security logs for a minimum of one year is directly about the duration logs must be stored. Option D, 'Log retention requirements,' is the practice that defines this storage duration, ensuring compliance with regulations such as PCI DSS or SOX. This is a policy-driven specification of how long logs are kept, not how they are reviewed, formatted, or collected.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Log review frequency
Why it's wrong here
Log review frequency dictates how often security personnel or automated systems analyze collected logs for anomalies, security incidents, or policy violations. While crucial for proactive threat detection and operational security, it does not directly specify the mandated duration for which these log records must be stored. This metric focuses on the *act* of examination, not the *length* of storage, making it distinct from retention periods.
- ✗
Log format standardization
Why it's wrong here
Log format standardization ensures that security logs from various sources adhere to a consistent structure, schema, or syntax (e.g., CEF, LEEF, Syslog RFCs). This consistency significantly improves the efficiency of parsing, correlation, and automated analysis across different systems and tools. However, standardizing the format addresses the *interoperability and readability* of logs, not the regulatory or policy-driven duration for which they must be archived.
- ✗
Centralized log management
Why it's wrong here
Centralized log management involves consolidating security logs from multiple disparate sources into a single, secure repository or Security Information and Event Management (SIEM) system. This approach enhances efficiency in collection, storage, analysis, and incident response by providing a unified view of security events. While it facilitates the *management* of logs, including their storage, it does not inherently define or dictate the specific duration for which those logs must be retained according to organizational policy or external regulations.
- ✓
Log retention requirements
Why this is correct
Log retention requirements explicitly define the mandatory duration for which security logs must be stored and maintained by an organization. These requirements are typically driven by legal obligations (e.g., GDPR, HIPAA), industry regulations (e.g., PCI DSS), compliance frameworks, or internal corporate policies for forensic investigations, auditing, and historical analysis. They directly address the "how long" aspect of log management, ensuring data availability for specified periods.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.