A regulation requires the organization to retain security logs for one year, but the SIEM's searchable storage holds only thirty days and management will not increase SIEM storage costs. Which activity BEST meets the requirement?
Select an answer to reveal the explanation.
Short Explanation
You don't need every log on the expensive front shelf - most just need to be kept safe in the back room. Archiving moves older logs to cheaper storage that still proves nothing was changed. Growing the SIEM works, but the budget just said no.
Full Explanation
Archiving moves logs that are past their active investigation window into lower-cost storage while preserving them for the required retention period. Effective archives protect integrity, often through write-once storage, hashing, or immutable retention settings, so the logs remain defensible for audits or legal matters, and they support restoration into an analysis tool when an older event must be investigated. This satisfies the one-year requirement without expanding SIEM storage. Extending the SIEM's searchable storage would technically keep a year of data online, but the scenario states management will not increase SIEM storage costs, so it fails the stated constraint. Deleting logs after thirty days and keeping monthly summaries does not retain the security logs themselves; summaries cannot reconstruct individual events, which is what auditors and investigators need. Lowering logging levels reduces volume by discarding events that may be required, and it does nothing to extend retention of what remains. Exam caveat: archiving pairs with reporting and retention policy; the policy defines how long, and the archive implements it. Operational check: confirm the archive's retention lock matches one year, then restore a sample day from several months ago and verify its hashes match the originals.