Exercise 3: Why Neither Retention Extreme Is Correct — Possible Solution
====================================================================

WHAT GOES WRONG WITH A TOO-SHORT RETENTION WINDOW
------------------------------
Per this chapter, "keeping backups for too short a window limits how
far back a recovery can reach - directly relevant when a problem isn't
noticed immediately." If old backups are deleted quickly, and a
problem isn't discovered until after the last clean backup has already
aged out of the retention window, there may be no genuinely
uncorrupted copy left to restore from at all - the retention window
itself becomes the limiting factor on what can be recovered.

THE SPECIFIC EARLIER CHAPTER THIS CONNECTS TO
------------------------------
Per this chapter, this "directly [connects to] Chapter 4's own
three-week silent failure" - the backup job that had actually stopped
running for three weeks before anyone noticed, per Chapter 4's own
resolution of the Chapter 1 ticket. A short retention window
compounds exactly this kind of undetected problem: if backups are
purged quickly, and a failure (or a slow-burning compromise) isn't
caught right away, there may not even be a valid recent copy left by
the time anyone goes looking.

WHAT GOES WRONG WITH A TOO-LONG RETENTION WINDOW
------------------------------
Per this chapter, keeping backups indefinitely "raises storage cost and
creates more copies of sensitive data sitting around, each one its own
potential exposure." This connects directly to this chapter's own
opening point that backups are an attractive target - every additional
retained copy is one more place sensitive data exists that has to be
protected, encrypted, and access-controlled, expanding the attack
surface without necessarily adding any real recovery value beyond a
certain point.

WHY A DELIBERATE WINDOW SOLVES BOTH PROBLEMS AT ONCE
------------------------------
Per this chapter, "a deliberate, defined retention window balances
both concerns, rather than defaulting to either extreme." The window
needs to be long enough to cover the realistic delay between a problem
occurring and someone noticing it (informed by real incidents like
Chapter 4's own), while still being short enough that the number of
retained copies doesn't become an unmanaged, growing liability in its
own right.

WHY THIS WORKS AS AN ANSWER
------------------------------
It explains the specific risk of too-short retention, names Chapter 4's
own three-week silent failure as the concrete earlier example this
risk connects to, explains the specific risk of too-long retention,
and explains why a deliberately chosen middle window addresses both
risks rather than picking one extreme.