What action should be taken to preserve evidence after a security incident?

• A. Preserve evidence and provide a detailed account as part of the security procedures.
• B. Immediately share sensitive details publicly.
• C. Delete all logs after the incident.
• D. Defer until the next shift.

Answer: (A)

Preserving evidence is about keeping the data and artifacts from a security incident intact so they can be analyzed later. This means avoiding any alterations to systems or records, and instead capturing and securing logs, system images, configurations, and a clear timeline of what happened. A proper process also includes documenting every action taken during the incident and maintaining a clear chain of custody, often in coordination with incident response and legal or compliance teams. By doing this, you create a reliable record that supports investigation, forensics, and post-incident learning.

That’s why this option is the best. It explicitly calls for preserving evidence and providing a detailed account as part of security procedures, which protects the integrity of the investigation and helps determine what occurred and how to prevent recurrence. The other choices would undermine investigation: sharing sensitive details publicly can expose confidential information and hinder response; deleting logs destroys crucial data; and waiting or deferring the process can let the incident worsen and lose important evidence.