Preserve and collect evidentiary data while maintaining a documented chain of custody for potential legal actions is correct.

This is because the primary goal of a forensic examination during analysis is to secure data in a manner that preserves its integrity and provenance so that it can be relied upon in investigations or in court. A proper forensic process focuses on collection methods that avoid altering evidence and on documenting every action that touches the data.

Forensic activities therefore include creating forensically sound images of storage, capturing volatile memory and relevant logs, recording timestamps and cryptographic hashes, and keeping a documented chain of custody for each item. These practices ensure that evidence remains admissible and that investigators can reconstruct events with confidence.

Contain active threats using Cloud Logging and Security Command Center telemetry is incorrect because active containment and mitigation are operational steps that run alongside response efforts and they do not replace the need to preserve evidence. Containment is about stopping harm and is not the primary objective of forensic examination.

Record post-incident lessons and create a revised incident response playbook is incorrect because lessons learned and playbook updates belong to the post-incident or recovery phase. Those activities come after evidence collection and detailed analysis rather than being the main goal of the forensic exam.

Attribute the intrusion to a threat actor and determine their motives is incorrect because attribution can be a longer term outcome that requires corroborating intelligence and context beyond preserved evidence. Attribution is not the immediate objective of collecting and maintaining forensic evidence.

Full AWS Practitioner Certification Question