(ISC)2 Certified in Cybersecurity Practice Exam

What is defined by a security information and event management (SIEM) retention policy?

1. Access control for sensitive data

2. The duration for log data retention

3. Methods for encryption and decryption

4. Standards for software development

The correct answer is: The duration for log data retention

A security information and event management (SIEM) retention policy specifically defines the duration for which log data is to be retained. This policy is critical for organizations as it establishes guidelines for how long security logs, incidents, and associated data will be stored. Retaining log data for an appropriate period is essential for various reasons including compliance with regulations, ensuring that enough data is available for forensic analysis in case of security incidents, and optimizing storage costs. Therefore, a well-defined retention policy helps organizations manage their data lifecycle effectively while maintaining the ability to respond to security incidents or audits based on historical data. The other options, while related to security best practices, do not pertain directly to the function of a SIEM retention policy. Access control is concerned with who can access what information, encryption relates to securing data, and software development standards focus on the guidelines for creating reliable applications. None of these elements address the specific aspect of how long data logs should be kept as dictated by a SIEM retention policy.