CAS-004 Security Operations Practice Question
During a digital forensics investigation, an analyst needs to acquire the contents of RAM from a compromised server. Which order of volatility should the analyst follow?
⚠ Common exam trap
CAS-005 often tests the order of volatility — candidates pick 'hard drive first' because disk imaging is the most familiar forensic step, but the rule is always most-volatile-first, and RAM beats disk every time.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Capture RAM first, then the hard drive
The order of volatility (RFC 3227) dictates that the most volatile evidence be collected first: CPU registers and cache, then RAM, then swap/pagefile, then network state, then disk. RAM is far more volatile than disk, so it must be captured before the hard drive image. This preserves evidence like running processes, encryption keys, and network connections that vanish on power-off.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Capture the swap file first, then RAM
Why it's wrong here
Swap files reside on disk, so capturing one before RAM contradicts volatility ordering and risks losing memory-resident evidence such as encryption keys and running processes. It is tempting because swap can hold paged-out memory contents, which matters when RAM is already lost, but volatile RAM must be acquired first.
- ✗
Capture network connections first, then RAM
Why it's wrong here
Network connections are volatile, yet capturing them before RAM delays the most perishable evidence; memory acquisition should precede or accompany them. It is tempting because live connection data reveals active attacker sessions, which matters in network-focused investigations, but RAM itself disappears fastest on shutdown.
- ✗
Capture the hard drive image first, then RAM
Why it's wrong here
Imaging the hard drive before RAM inverts the order of volatility; memory contents, including running processes and encryption keys, are lost once the server powers down. It is tempting because drive images capture persistent artefacts comprehensively, which suits later static analysis, but volatile memory must be collected first.
- ✓
Capture RAM first, then the hard drive
Why this is correct
RAM is volatile and lost on power-off, so it must be captured before the hard drive, which retains data persistently. This ordering follows the RFC 3227 volatility principle, satisfying the stem's requirement to acquire the most perishable evidence first.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.