Define log retention policy and its importance for forensics and compliance.

• A. A policy specifying how to encrypt and store backups.
• B. A policy specifying what logs to retain, retention duration, and storage location; Critical for investigations, audits, and regulatory compliance
• C. A policy for archiving logs only during outages
• D. A policy that prescribes deleting logs after 1 day

Answer: (B)

A log retention policy defines what logs must be kept, for how long, and where they are stored. This matters because forensics rely on a reliable, preserved record of events to reconstruct what happened, determine the sequence of actions, and verify user or system activity. The retention duration ensures you keep the relevant data long enough to investigate incidents, respond effectively, and satisfy legal or regulatory timelines; too short a window can create gaps that hinder investigations.

From a compliance perspective, many regulations require retaining logs for specific periods and in auditable, tamper-resistant formats. A formal policy helps demonstrate due diligence, supports audits, and reduces the risk of penalties. A solid policy also covers scope (which logs are included), how long each type is kept, where and how they’re stored, access controls, and methods for secure disposal when retention periods end.