A serverless function that processes payment events runs for a few seconds per invocation, and its local log files disappear when the execution environment is torn down. Investigators need those logs for future incident analysis. Which control best preserves the evidence?
Select an answer to reveal the explanation.
Short Explanation
Ephemeral functions are like a pop-up shop that packs up every night; if you don't send the receipts to head office as you go, they're gone. You stream the logs out in real time. The trap is trying to keep the shop open longer instead of shipping the records.
Full Explanation
Ephemeral and serverless computing create execution environments that exist only for the life of an invocation, and anything written locally is lost when the environment is reclaimed. Evidence must therefore leave the function while it runs: logs are streamed to a centralized logging service or SIEM that is access-controlled, retained according to policy and, ideally, protected against modification, so investigators have a durable record correlated across invocations. Extending the timeout only delays teardown by seconds or minutes and still leaves collection to a race no analyst can win across thousands of invocations. Nightly snapshots of temporary storage fail because that storage does not survive the end of each invocation, and functions do not expose it for snapshotting. Rehosting on a long-lived virtual machine abandons the serverless design, adding patching and capacity duties, to solve a problem that centralized logging solves directly. Exam caveat: the outline pairs ephemeral computing and serverless with virtualization security; least-privilege execution roles for functions are the other control frequently tested alongside centralized logging. Operational check: invoke the function, then confirm the entries appear in the central store with timestamps, request identifiers and the function version, and that the function's role cannot delete them.