What is a best practice step when containing a cyber incident to preserve evidence?

• A. Isolate affected hosts, preserve evidence, and document actions taken.
• B. Reimage all systems immediately
• C. Post details of incident on public forums
• D. Ignore logs to speed up response

Answer: (A)

During incident containment, the most effective step is to isolate the affected hosts, preserve evidence, and document actions taken. Isolating the systems stops the attacker from spreading and minimizes further damage, while preserving evidence ensures you capture the original state and artifacts (disk images, memory snapshots, logs, network captures) before any changes are made, which is vital for a later forensic analysis and a defensible trail. Documenting actions creates a clear chain of custody and a chronological record of what was done, by whom, and when, supporting the investigation and any potential legal or regulatory reviews. Other approaches don’t fit as well because reimaging all systems immediately can destroy volatile data and contaminate the evidence, posting incident details publicly can expose sensitive information and hinder the investigation, and ignoring logs eliminates critical data needed to reconstruct what happened and how the breach occurred.