CAS-004 Security Operations Practice Question
A security analyst is investigating a security incident and needs to collect volatile evidence from a compromised Windows system. The analyst must preserve the evidence in a forensically sound manner. Which TWO of the following actions should the analyst take to ensure the integrity of the volatile data? (Choose two.)
⚠ Common exam trap
The trap here is assuming that shutting down the system preserves evidence, when it actually destroys volatile data like RAM.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Document the system time and date
To preserve volatile evidence, the analyst must capture memory contents and document the system time. Memory dumps capture running processes and network connections, which are lost on shutdown. Documenting system time ensures accurate timeline correlation. Actions like antivirus scans, shutdown, and defragmentation modify the system and destroy evidence, so they should be avoided. Thus, the correct actions are memory capture and time documentation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Document the system time and date
Why this is correct
Recording the system time and date is essential for establishing a timeline and correlating events across logs. Time discrepancies can affect the interpretation of evidence, so documenting the current system time (including timezone) before any changes is a fundamental forensic step. This helps maintain the integrity and context of the volatile data collected, ensuring that timestamps in memory or logs are accurately mapped.
- ✗
Defragment the hard drive
Why it's wrong here
Defragmentation reorganizes files on the disk, which would alter the file system and potentially overwrite unallocated space that might contain evidence. This is highly destructive to forensic artifacts and is never performed during evidence collection. It also does not address volatile data preservation. Hence, it is incorrect.
- ✗
Run a full antivirus scan
Why it's wrong here
Running an antivirus scan modifies the system by accessing files, potentially changing timestamps, and may quarantine or delete malware, which alters the evidence. This is not forensically sound as it can destroy volatile data and compromise the integrity of the investigation. Antivirus scans should be avoided during evidence collection to prevent contamination.
- ✓
Capture a memory dump using a tool like WinPmem
Why this is correct
Capturing a memory dump preserves the contents of RAM, including running processes, network connections, and encryption keys. This is critical volatile evidence that can be lost if the system is powered off. Using a tool like WinPmem ensures a forensically sound acquisition by creating a bit-for-bit copy of memory. This action directly addresses the need to preserve volatile data and is a standard step in incident response.
- ✗
Shut down the system to preserve the state
Why it's wrong here
Shutting down the system would erase volatile data such as RAM contents, network connections, and running processes. This action is contrary to preserving volatile evidence. In incident response, systems are typically left powered on until volatile data is captured, unless there is an immediate threat. Therefore, this is not appropriate.
Go deeper
Related to this question
About these practice questions
One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.