CS0-003 Order of Volatility Practice Question
A forensic analyst is investigating a suspected data breach involving a compromised workstation. The analyst wants to collect volatile data in accordance with the order of volatility. Which sequence of data collection is correct?
⚠ Common exam trap
Many candidates incorrectly place network connections after disk, assuming they are less volatile. However, network connections are more volatile than disk because they represent active communications that can be lost quickly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CPU registers → RAM → Swap → Network connections → Disk → Archived media
The correct order of volatility is CPU registers, RAM, swap, network connections, disk, archived media. This sequence captures the most volatile data first: CPU registers are the most volatile, followed by RAM, then swap, then network connections, then disk, and finally archived media.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disk → RAM → Swap → CPU registers → Network connections → Archived media
Why it's wrong here
Incorrect: Starts with disk, which is persistent and least volatile among the early items. Volatile data like RAM and CPU registers should be captured first.
- ✓
CPU registers → RAM → Swap → Network connections → Disk → Archived media
Why this is correct
Correct: RAM (most volatile) first, then CPU registers, then swap, then network connections, then disk, then archived media. This follows the standard order of volatility.
- ✗
Network connections → CPU registers → RAM → Swap → Disk → Archived media
Why it's wrong here
Incorrect: Network connections are placed first, but they are less volatile than RAM and CPU registers. The sequence should start with memory.
- ✗
CPU registers → RAM → Swap → Disk → Network connections → Archived media
Why it's wrong here
Incorrect: While CPU registers and RAM are correctly first, network connections are placed after disk, which violates the order of volatility because network connections are more volatile than disk.
Go deeper
Related to this question
About these practice questions
One of 701 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.