Which retention approach best serves an environment with both routine operational troubleshooting and a compliance obligation on audit records?

The correct approach sets retention per data type, keeping high-volume operational telemetry for the shorter investigation window and audit records for the full period the regulation requires. Operational telemetry is high volume and short-lived in value; audit records are low volume and legally significant. Setting each to its own requirement satisfies both without over-provisioning storage. Applying the audit period uniformly to every kind of data is incorrect because applying a long audit period to high-volume telemetry multiplies storage cost for data nobody will query. Applying the operational period uniformly and granting exceptions when auditors request data is incorrect because compliance cannot be handled by exception after the data has already been deleted. Retaining nothing beyond the current day and reconstructing history from alert notifications is incorrect because alert notifications record that something fired, not the underlying data needed to investigate or to satisfy an audit. For the exam, expect retention to be set per data type rather than as one global value.