A retail chain runs three Threat Defense devices in separate regions, and auditors must be able to search a full year of connection events even though each Management Center database is near capacity. Management has frozen spending on any new on-premises log servers. Which Security Analytics and Logging design keeps the full audit year searchable without new on-premises servers?

Sending events from all three Threat Defense devices to Cisco cloud storage through Security Analytics and Logging, with a subscription providing at least one year of retention, addresses the full set of needs: the audit period is retained and searchable, the Management Center databases need not carry the full history, and no on-premises log server is added. Forwarding to the existing SIEM is a technically credible centralized-search design, but it bypasses the requested Security Analytics and Logging cloud-storage design; it would be appropriate only if the requirement allowed another logging platform. A general enterprise cloud data lake can also provide indexed, searchable retention without new local servers, but it is not the specified Security Analytics and Logging service, so its capabilities and retention do not establish that the requested SAL design is in place. A cold archive can lower storage costs and preserve a year of records, yet requiring restoration before search means the full audit year is not immediately searchable as required. Exam caveat: distinguish retention duration from searchability—an archived record may be retained but unavailable for immediate queries. Practical check: verify that all three devices are sending connection events to the intended cloud service, the subscription’s retention covers at least a year, and a representative older event can be queried without restoration.