A seasoned forensic investigator is working on a case involving an advanced persistent threat (APT)...

Option B is the strongest answer because the problem described is not simply a lack of staff or tools, but the fact that the organization’s log data is unstructured and difficult to use during a major investigation. Forensic readiness depends on ensuring that relevant evidence sources, especially logs, are available, organized, preserved, and accessible so investigators can reconstruct events efficiently when an incident occurs.

In an APT investigation, the ability to trace initial compromise, lateral movement, persistence, and exfiltration depends heavily on reliable log analysis. When logs are poorly structured or not centrally managed, investigators struggle to correlate events, build timelines, and identify the root cause. That directly weakens forensic readiness.

The other options may be helpful in a general security program, but they do not address the core failure described here. Regular audits improve posture, advanced tools can help analysis, and more investigators may increase capacity, but none of those solve the specific readiness gap of poorly organized log evidence. Therefore, the most accurate answer is that the corporation overlooked the importance of keeping log data structured and readily accessible for investigations.