Why is deleting telemetry immediately after an alert has fired a poor retention practice?
Select an answer to reveal the explanation.
Short Explanation
An alert is the start of the investigation, not the end of it. If you delete telemetry right after it fires, you're throwing away exactly what the responder needs to figure out why it happened.
Full Explanation
The correct choice says root-cause analysis depends on the data leading up to and following the alert, so discarding it leaves the notification with no supporting evidence. An alert tells you something happened; it does not tell you why. Establishing cause means looking at the trend before it, the correlated services around it, and the recovery behaviour after it - all of which is telemetry. The choice claiming Instana requires a minimum retention period and will refuse the configuration is incorrect because the practice is a policy mistake rather than a configuration the product blocks. The choice claiming deleting data increases storage consumption because of index rebuilds is incorrect because deletion reduces stored volume; the objection is loss of investigative value. The choice claiming alerts cannot fire at all unless historical telemetry is retained is incorrect because alerting evaluates current conditions and does not require long history to trigger. For the exam, connect retention length to the investigation window teams actually need.