hardMultiple ChoiceObjective-mapped
CS0-003 Practice Question: A security analyst is investigating a potential…
A security analyst is investigating a potential data breach and needs to collect evidence from a compromised Windows server. The server is still running, and the analyst wants to capture memory, network connections, and process list without writing unnecessary data to disk. Which of the following sequences of commands (tools) should the analyst use to adhere to order of volatility?
⚠ Common exam trap
CompTIA often tests the misconception that network connections or process lists are more volatile than memory, leading candidates to choose options that capture them first, but memory is the most volatile because it is lost on power loss and contains critical runtime artifacts like decrypted data and active malware code.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
memory dump, netstat -an, then tasklist
It follows the order of volatility (OOV) principle, which dictates that the most volatile data (memory) should be captured first, followed by network connections (netstat -an), and then the process list (tasklist). Memory is lost when the system is powered off, so it must be collected before any other evidence. Network connections and process lists are less volatile but still transient, and capturing them after memory ensures minimal data loss while avoiding unnecessary writes to disk that could overwrite evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
tasklist, netstat -an, then memory dump
Why it's wrong here
This sequence is incorrect because it violates the principle of volatility in digital forensics. The 'tasklist' command captures a list of running processes, which is less volatile than active network connections captured by 'netstat -an', and significantly less volatile than the contents of RAM captured by a 'memory dump'. Capturing less volatile data first risks the loss of critical, ephemeral evidence residing in memory or active network buffers before it can be preserved.
- ✗
memory dump, disk image, then network connections
Why it's wrong here
This option is incorrect due to an improper order of volatility after the initial memory capture. While 'memory dump' correctly addresses the most volatile data, capturing a 'disk image' next is wrong because disk data is persistent and far less volatile than active 'network connections'. Network connections, which are dynamic and constantly changing, should be captured immediately after memory to preserve their state before they are lost or altered, prior to imaging static storage.
- ✓
memory dump, netstat -an, then tasklist
Why this is correct
This option correctly follows the order of volatility for evidence collection in a digital forensics investigation. A 'memory dump' captures the most volatile data, the contents of RAM, which can contain critical artifacts like running processes, open files, and network connections. Subsequently, 'netstat -an' captures active network connections, which are less volatile than RAM but more dynamic than a process list. Finally, 'tasklist' captures the running processes, which are the least volatile of these three dynamic data types, ensuring that the most ephemeral evidence is preserved first.
- ✗
netstat -an, tasklist, then memory dump
Why it's wrong here
This sequence is incorrect because it fails to prioritize the capture of the most volatile evidence. 'netstat -an' captures network connections, which are dynamic but less volatile than the contents of system memory. Capturing the 'tasklist' next, which is even less volatile than network connections, before finally performing a 'memory dump', allows valuable in-memory artifacts to be overwritten, modified, or lost due to ongoing system operations during the initial, less critical data collection steps.
Go deeper
Related to this question
About these practice questions
This CS0-004 question is part of Courseiva's 236-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.