Under the CHFI v11 objectives related to Cloud Forensics and AWS Forensics , log preservation is a critical requirement for effective investigation and legal admissibility. In Amazon Web Services, CloudWatch Logs retention policies allow investigators to control how long log data is stored before it is automatically deleted. Modifying retention policies for individual log groups ensures that relevant forensic artifacts—such as authentication logs, API activity records, and system events—remain available for analysis throughout the investigation lifecycle.

In this scenario, the investigator’s goal is not to analyze or query logs immediately, but to extend or manage the lifespan of log data so that it is not lost due to default retention limits. This aligns precisely with the feature that allows investigators to modify retention policies for individual log groups . CHFI v11 highlights the importance of preserving cloud-based evidence early, as cloud logs may be ephemeral and subject to automatic deletion if not properly configured.

Option A refers to general monitoring capabilities, while Option B focuses on querying and searching log data using Logs Insights—both are analytical functions, not retention management. Option D involves alerting mechanisms and does not control log storage duration.

The CHFI Exam Blueprint v4 explicitly includes logs in AWS and cloud evidence acquisition , emphasizing retention configuration as a key forensic readiness and investigation task, making Option C the correct and exam-aligned answer