Start here. This is the direct spoken answer to practice first.
Why this question matters
Collecting the richest artifact first can create unnecessary risk and still answer the wrong question. The useful skill is moving from a broad symptom to the cheapest evidence that can narrow the next decision.
I choose the artifact from the question I need to answer. Live counters are the first pass for trends such as CPU, allocation rate, heap size, GC activity, exception rate, and ThreadPool pressure. A trace records events over time and can show CPU hot paths, waits, contention, and request or runtime activity during a representative window. A stack snapshot shows what managed threads are doing at one moment, which is useful for a consistent hang or blocking pattern. A GC dump focuses on the managed heap, object counts, and roots, while a full process dump preserves threads, stacks, exceptions, locks, managed memory, and broader process state. A profiler gives deeper CPU or allocation analysis when lightweight evidence has narrowed the problem. I start small, preserve the affected time and instance, then escalate only when the current evidence cannot answer the next question.