An organization collects logs from 500 endpoints but only retains them for 7 days before deletion to manage storage costs. A security incident is discovered 15 days after the initial compromise. What critical problem does this retention policy create?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — b is correct because a 15-day-old initial compromise falls outside the 7-day retention window, meaning the logs capturing the attacker's initial access, lateral movement, and early actions are permanently deleted, preventing accurate incident reconstruction. A is wrong because log format compatibility is a parsing issue unrelated to retention period.
Full Explanation
B is correct because a 15-day-old initial compromise falls outside the 7-day retention window, meaning the logs capturing the attacker's initial access, lateral movement, and early actions are permanently deleted, preventing accurate incident reconstruction. A is wrong because log format compatibility is a parsing issue unrelated to retention period. C is wrong because GDPR governs personal data retention, not security log retention; the comparison is incorrect. D is wrong because baselining is a monitoring concern but not the specific critical problem caused by insufficient retention in this scenario.