Why is it important for an Incident Responder to copy malicious files to the ATP...

To have a copy of the file policy enforcement

To test the effectiveness of the current assigned policy settings in the Symantec Endpoint Protection Manager (SEPM)

To create custom IPS signatures

To document and preserve any pieces of evidence associated with the incident