What is a common mistake with incident response in cloud in Cloud Security?

Deleting compromised resources immediately can destroy forensic evidence and make root-cause analysis impossible. In practice, the value of this concept comes from understanding where it belongs in the architecture, what problem it solves, and what constraints or tradeoffs it introduces.