The correct answer is Delaying evidence collection until the authorization review phase.

Waiting until an authorization review to gather evidence is least advisable because many forms of evidence are ephemeral and can be lost altered or rendered incomplete over time. Continuous or timely collection preserves timestamps preserves chain of custody and reduces the risk that logs are rotated overwritten or that system state changes before it can be demonstrated. Auditors and assessors expect reproducible and verifiable artifacts not retrospective reconstructions.

Collecting system logs and time stamped screenshots as supporting artifacts is not least advisable because these items provide direct objective evidence of control operation and system state. Well preserved logs and screenshots help demonstrate that controls were active at specific times and support forensic and compliance reviews.

Incorporating evidence capture into routine operational processes is also not least advisable because it ensures evidence is created consistently and automatically. Embedding evidence capture into operations reduces human error and makes it practical to retain continuous proof that controls are implemented and functioning.

Keeping detailed audit trails and scheduled maintenance records is likewise not least advisable because audit trails and maintenance records provide context and history for changes and control activities. These records support accountability and make it easier to correlate events and verify that required maintenance and reviews occurred as claimed.

Full AWS Practitioner Certification Question