Correct answers: A, B, C, and E. Preserve flight logs and authorizations; Check the facts against official sources; Follow mandatory reporting or notification duties; Update procedures or training if a control failed.
A useful breach response preserves facts, checks obligations, reports when required, and prevents recurrence. Deleting evidence makes the situation worse.