The correct approach is to create a new Logs Bucket with the desired retention period and a Sink to collect the specified logs, using the inclusion filter of the _Required Sink to capture the necessary logs. The other options are incorrect because: the _Default Logs Bucket does not contain the required logs (Admin Activity audit logs), the _Required Logs Bucket and Sink cannot be modified, and the _Default Logs Sink inclusion filters do not capture the specified logs. For more details, refer to the documentation on Required buckets, Default buckets, and User buckets.