Study. uk . com
  1. Home
  2. All questions
  3. Question 435

CISSP study material · question 435 of 500

An investigator asks the logging team to keep a set of firewall logs that the schedule would delete next week. Which form of archival is this, and how does it differ from the routine kind?

  1. Log retention, which keeps logs for legal reasons; preservation is the routine scheduled archiving.
  2. Log rotation, which closes the current file so it can be held; retention covers the archive.
  3. Log preservation, which keeps logs that would normally be discarded because they matter to an investigation; retention is the routine scheduled archiving.
  4. Log reduction, which keeps only the entries of interest; retention covers the rest.
Show the answer

Answer: C. Log preservation, which keeps logs that would normally be discarded because they matter to an investigation; retention is the routine scheduled archiving.

SP 800-92 splits archival into retention, archiving logs regularly as part of standard operations, and preservation, keeping logs that would normally be discarded because they record activity of particular interest.

Source: NIST SP 800-92 (NIST) — SP 800-92 > 3.2 Functions

Challenge yourself on this topic → Study as cards