CAS-004 Security Operations Practice Question
A security analyst is collecting evidence from a compromised workstation. Which of the following should be collected first to preserve volatile data?
⚠ Common exam trap
CAS-005 often tests the misconception that hard drive images should be collected first, when in fact volatile memory must be preserved before any non-volatile data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Memory dump
Volatile data such as memory contents, running processes, network connections, and encryption keys are lost when the system is powered off or rebooted. A memory dump must be collected first to preserve this evidence. Hard drive images, network captures, and event logs are either non-volatile or can be collected later without the same urgency.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Memory dump
Why this is correct
A memory dump captures RAM contents, which are lost when the workstation powers off, making it the most volatile evidence. Collecting it first satisfies the stem's requirement to preserve volatile data before disk, logs or other less perishable sources.
- ✗
Hard drive image
Why it's wrong here
Imaging the hard drive captures non-volatile data and requires powering the system down or using a write blocker, destroying RAM contents such as running processes and cached credentials. Drive imaging is correct once volatile artefacts have been captured and the host can be shut down.
- ✗
Network capture
Why it's wrong here
A network capture only records traffic still traversing the wire; it misses RAM-resident artefacts such as running processes, open handles and cached credentials. Packet capture suits live incident monitoring or malware command-and-control analysis, not the first step of host-based volatile evidence collection.
- ✗
Event logs
Why it's wrong here
Event logs reside on disk, so they survive until overwritten and are not the most volatile artefact; RAM contents such as running processes and network connections vanish on power-off. Logs are collected later, after memory, as part of the order-of-volatility sequence.
Go deeper
Related to this question
About these practice questions
One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.