A companys legal and regulatory departments have drafted a new policy in which emails must be retained for no longer than three years. Which of the following locations should an administrator…

Email clients such as Outlook on local workstations often store local copies of messages in PST or OST files; if these are not subject to the retention policy, emails can persist on end-user machines beyond the three-year limit even after server-side deletion.

Backup tapes can contain snapshots of email data that predate the retention limit; without configuring tape retention or expiration policies, expired emails remain recoverable on backup media in violation of the policy.

Domain controllers handle directory services and authentication, not email storage; they do not hold message data subject to an email retention policy.

The email server is the primary authoritative store for organizational email and must have automated retention or expiration rules configured to purge messages older than three years across all mailboxes.

SMTP gateways relay messages in transit and do not persistently store email; they are not a long-term storage location requiring retention policy configuration.

Proxy servers manage and cache web traffic, not email messages; they play no role in email retention compliance.