In the context of hosted merchants or service providers, what process should be enabled to support investigations?

In the context of hosted merchants or service providers, what process should be enabled to support investigations?

• A. Timely forensic investigation processes
• B. Immediate data deletion
• C. Auto-legal escalation
• D. Public disclosure of breaches

Answer: (A)

The situation being tested is the ability to quickly and effectively investigate breaches in hosted merchant or service provider environments. The best approach is to have timely forensic investigation processes in place. This means readiness to collect, preserve, and analyze evidence from systems, logs, and network activity without altering the data, so investigators can determine how a breach occurred, what was affected, and the scope of impact. Such processes ensure a proper chain of custody and enable accurate root-cause analysis, remediation, and any required reporting to regulators or card brands. Immediate data deletion would destroy vital evidence and impede investigations. Auto-legal escalation and public disclosure are not the core investigative processes; they may occur as part of incident response or policy, but they do not enable the actual investigation to determine what happened.

The situation being tested is the ability to quickly and effectively investigate breaches in hosted merchant or service provider environments. The best approach is to have timely forensic investigation processes in place. This means readiness to collect, preserve, and analyze evidence from systems, logs, and network activity without altering the data, so investigators can determine how a breach occurred, what was affected, and the scope of impact. Such processes ensure a proper chain of custody and enable accurate root-cause analysis, remediation, and any required reporting to regulators or card brands.

Immediate data deletion would destroy vital evidence and impede investigations. Auto-legal escalation and public disclosure are not the core investigative processes; they may occur as part of incident response or policy, but they do not enable the actual investigation to determine what happened.