CS0-003 Incident Response and Management Practice Question
During a forensic analysis, an analyst needs to collect data in order of volatility. Which of the following represents the correct order from most volatile to least volatile?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CPU registers, RAM, swap, disk, logs
The order of volatility dictates that volatile data in memory (CPU registers, RAM) is collected first, then less volatile data like swap, disk, and logs. The correct sequence is CPU registers, RAM, swap, disk, then logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disk, swap, RAM, CPU registers, logs
Why it's wrong here
This sequence places disk storage first and CPU registers second-to-last, which is exactly backward from the RFC 3227 order of volatility; disk data can persist for years while CPU register contents vanish in nanoseconds, so collecting disk before RAM guarantees the loss of the most fragile evidence.
- ✓
CPU registers, RAM, swap, disk, logs
Why this is correct
This matches the RFC 3227 order of volatility precisely: CPU registers and cache decay in nanoseconds, RAM contents are lost on power-off within seconds, swap/pagefile persists slightly longer on disk, and log files and disk data remain until explicitly deleted, so evidence must be captured in exactly this sequence to avoid destroying the most fragile artifacts first.
- ✗
RAM, CPU registers, swap, disk, logs
Why it's wrong here
Placing RAM ahead of CPU registers inverts the two most transient data sources; register and cache contents change on every clock cycle and are overwritten almost instantly, making them more volatile than main memory, which can persist for a brief window even without continuous CPU activity.
- ✗
Logs, disk, swap, RAM, CPU registers
Why it's wrong here
Starting with log files and ending with CPU registers collects the most durable, already-persisted evidence first while leaving the most fragile, fastest-decaying data for last, which is the opposite of forensically sound practice since volatile evidence must always be imaged before less volatile sources are touched.
Go deeper
Related to this question
About these practice questions
One of 701 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.