A cloud service provider requires its customer organizations to enable maximum audit logging for its data storage service and to retain the logs for the period of three months. The audit logging gener

Keeping the most recent week's logs in online (hot) storage ensures fast, immediate access for active investigations and compliance checks, while moving older logs to near-line (warm) storage significantly reduces costs without sacrificing reasonable retrieval times. Near-line storage is appropriate for logs older than a week because they are infrequently accessed but may still need to be retrieved within a practical timeframe during the three-month retention window, making this the most balanced and cost-effective tiered approach.

Keeping all logs in online storage is cost-prohibitive for extremely high log volumes spanning three months, as online storage is the most expensive tier and is unnecessary for infrequently accessed older logs.

Keeping all logs in offline storage is inappropriate because recently generated logs (e.g., last week's) typically require fast access for active monitoring and incident response, and offline retrieval introduces unacceptable delays.

Moving logs older than a week directly to offline storage is too aggressive, as offline retrieval is slow and cumbersome; near-line storage provides a better middle ground for logs that are not current but still within the active retention period and may need timely retrieval.