mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: An analyst needs to collect volatile data from a…
An analyst needs to collect volatile data from a live host before performing a memory dump. Which data is most volatile?
⚠ Common exam trap
Cisco often tests the order of volatility (RFC 3227) by making candidates confuse persistent disk-based data (registry, logs, file metadata) with transient memory-based data, so the trap is assuming that any system artifact is equally volatile when network state is actually the most ephemeral.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network connections
Network connections are the most volatile data because they change rapidly as packets flow and sessions are established or torn down. In live response, the current state of TCP/UDP connections (e.g., via netstat -ano) can be lost the instant the system is powered off or the network cable is pulled, making them more ephemeral than registry data, file system metadata, or event logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Registry data
Why it's wrong here
Registry is relatively stable and changes infrequently.
- ✓
Network connections
Why this is correct
Network state changes with every packet, making it highly volatile.
- ✗
File system metadata
Why it's wrong here
File metadata changes slowly compared to network connections.
- ✗
Event logs
Why it's wrong here
Event logs are written asynchronously and are less volatile.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.