CAS-004 Security Operations Practice Question
During a digital forensics investigation of a compromised Linux server, the investigator needs to preserve the evidence in a forensically sound manner. The server is still running. Which of the following should the investigator do first?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Capture the contents of RAM using a tool like LiME or fmem
According to the order of volatility, volatile data like memory should be captured first. On a running system, capturing memory preserves data that would be lost on shutdown.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Pull the power cord to preserve the disk state
Why it's wrong here
Pulling power loses volatile data; it is better to capture memory first.
- ✗
Create a forensic image of the hard drive using dd over a network connection
Why it's wrong here
Disk imaging should be done after capturing volatile data, and over a network may alter evidence.
- ✗
Run the 'history' command to see recent user commands
Why it's wrong here
Running commands on a live system can alter evidence; memory capture should be prioritized.
- ✓
Capture the contents of RAM using a tool like LiME or fmem
Why this is correct
Capturing memory first preserves the most volatile data, including running processes and network connections.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.