An organization collects logs from 500 endpoints but only retains them for 7 days before deletion to manage storage costs. A security incident is discovered 15 days after the initial compromise. What critical problem does this retention policy create?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because a 15-day-old initial compromise falls outside the 7-day retention window, meaning the logs capturing the attacker's initial access, lateral movement, and early actions are permanently deleted, preventing accurate incident reconstruction. A is wrong because log format compatibility is a parsing issue unrelated to retention period.
Full explanation below image
Full Explanation
B is correct because a 15-day-old initial compromise falls outside the 7-day retention window, meaning the logs capturing the attacker's initial access, lateral movement, and early actions are permanently deleted, preventing accurate incident reconstruction. A is wrong because log format compatibility is a parsing issue unrelated to retention period. C is wrong because GDPR governs personal data retention, not security log retention; the comparison is incorrect. D is wrong because baselining is a monitoring concern but not the specific critical problem caused by insufficient retention in this scenario.