A responder must retain evidence of suspicious S3 access with a defensible chain of custody. Which two practices are appropriate? Select 2 answers.

1. Store evidence in a restricted repository with integrity verification and suitable retention.
2. Record evidence origin, collection time, collector identity, and subsequent handling.
3. Edit original log records to remove suspicious entries before sharing them.
4. Keep the only evidence copy on the compromised instance.
5. Use a public bucket as the default evidence repository.