Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Production diagnostics need enough access to inspect a live process, which is exactly why an improvised collection path can weaken isolation or expose sensitive memory. The capability should be designed and rehearsed before an urgent incident.
Diagnostic collection is a privileged production operation. Access is role-controlled, the engineer captures one bounded artifact from a chosen instance, and the application continues serving whenever the risk allows it. The artifact goes directly to encrypted restricted storage with a short retention period. Temporary access and files are removed when the investigation ends.