Audit logs must be retained for seven years, while debug logs need only 30 days.
Balance cost, privacy, and legal requirements.
Which audit-log approach is most appropriate?
Define retention, archive, and deletion policies by log purpose instead of applying one period to all logs.
Detailed explanation
Cost, privacy, and deletion-request risks grow unnecessarily.
Cost, privacy, and deletion-request risks grow unnecessarily.
Audit, operations, and sensitive-data purposes receive appropriate periods and approvals.
Audit, operations, and sensitive-data purposes receive appropriate periods and approvals.
Defaults differ and may not satisfy the required policy.
Defaults differ and may not satisfy the required policy.
Audit and investigation requirements may not be met.
Audit and investigation requirements may not be met.
Check official documentation
Compare the following points with the official documentation.
AWS CloudWatch Logs retention、S3 lifecycle、CloudTrail retentionの公式説明を確認する。
What to confirm
無期限・一律短期と、目的別保持ポリシーの違いを説明できる。
Key points
- Retention
- Audit
- Archive
- Deletion approval
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Purpose limitation
Keeping data longer than necessary increases cost and privacy risk.
Tamper resistance
Use Object Lock or permission separation to protect evidence during retention.