CS0-003 Incident Response and Management Practice Question
An incident responder needs to collect forensic evidence from a server that was attacked. The evidence includes network connections, running processes, memory contents, and disk data. According to the order of volatility, which piece of evidence should the responder collect FIRST?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network connections
The order of volatility dictates that the most volatile data (e.g., CPU registers, network connections) should be collected first. Network connections change rapidly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Memory contents
Why it's wrong here
While system memory (RAM) contains highly volatile data such as encryption keys and execution state, it is less volatile than active network connections and CPU registers. According to RFC 3227, memory contents should be captured immediately after routing tables, ARP caches, and active network connections are documented.
- ✓
Network connections
Why this is correct
Active network connections, routing tables, and ARP caches are extremely transient and can terminate or change in milliseconds as sessions close. Capturing these live state metrics first is critical before any local tools are run that might alter the network socket state or terminate active connections.
- ✗
Running processes
Why it's wrong here
Although running processes reside in volatile system memory, their state is relatively more stable than active network sockets, which can close instantly upon detection or command-and-control termination. Process lists and associated execution metadata are typically gathered during the memory acquisition phase, which occurs after capturing network state.
- ✗
Disk data
Why it's wrong here
Non-volatile storage media, such as hard drives and solid-state disks, retain data even when the system is powered down. Because this data persists across reboots, it represents the lowest tier of volatility in this list and must be imaged only after all volatile memory and network states have been safely preserved.
Go deeper
Related to this question
About these practice questions
This CS0-004 question is part of Courseiva's 701-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.