During an active incident, responders should always patch or restart an affected system immediately, even if doing so could destroy evidence.

### Why this is right The statement is false because the material advises preserving evidence and coordinating changes with incident responders before patching or restarting systems during an active incident. Immediate changes may disrupt containment or remove useful evidence. ### The concept Responders must balance urgent risk reduction with investigation and operational needs. A system may need isolation to stop spread, but a patch or restart can alter logs, volatile information, or system state. Decisions should consider the threat, safety and business impact, evidence needs, and available alternatives. This is not a rule to delay all fixes; it is a warning to coordinate changes rather than act automatically. ### The other options - **The statement is false**: “Always” ignores the need to preserve evidence and coordinate response actions. ### Watch out Fast action is not always sound action. The best immediate step depends on the incident and its risks. ### Terms - **Volatile information**: Data that may disappear when a system is powered off or changed. - **Chain of custody**: Documentation of who collected, handled, and transferred evidence. ### Remember During an active incident, coordinate changes so containment does not needlessly destroy evidence.