mediumMultiple ChoiceObjective-mapped
CS0-003 Practice Question: During forensic acquisition, which of the…
During forensic acquisition, which of the following types of data is considered the MOST volatile?
⚠ Common exam trap
CompTIA often tests the order of volatility by making candidates confuse 'network connections' as the most volatile because they change rapidly, but the key is that network connection data is stored in RAM, making RAM itself the most volatile component that must be acquired first.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
RAM.
RAM (Random Access Memory) is the most volatile data because it loses its contents immediately when power is removed. In forensic acquisition, the order of volatility dictates that RAM must be captured first, as it contains running processes, open network connections, and decrypted data that cannot be recovered from disk. Network connections, while volatile, are a subset of the data stored in RAM and are less critical to capture first.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Network connections.
Why it's wrong here
While network connections represent active communication streams and can be ephemeral, they are generally less volatile than the contents of RAM itself. Capturing network traffic typically involves packet sniffers or firewall logs, which record data as it traverses the network interface, rather than residing solely in the system's most volatile memory. The state of a connection might change, but the data in RAM is constantly being overwritten and accessed at a much higher frequency.
- ✗
Disk.
Why it's wrong here
Disk storage, whether HDD or SSD, is fundamentally non-volatile, meaning data written to it persists even when power is removed from the system. This characteristic makes disk data relatively stable and predictable for forensic acquisition, as its contents do not rapidly change or disappear simply due to system operation or power loss. Therefore, it is not considered the most volatile data type requiring immediate capture in a live forensic scenario.
- ✗
Page file.
Why it's wrong here
The page file, or swap space, is a dedicated area on a hard drive or solid-state drive used by the operating system to temporarily store portions of RAM that are not actively in use. Since it resides on disk, it inherits the non-volatile properties of disk storage, meaning its contents persist across reboots or power cycles, unlike true volatile memory. While it contains memory-like data, its disk-based nature makes it significantly less volatile than actual RAM.
- ✓
RAM.
Why this is correct
Random Access Memory (RAM) is the most volatile data type in a computer system, constantly being overwritten and updated by the CPU and active processes. Its contents are lost immediately upon power loss or system shutdown, making it critical to acquire during live forensic investigations before it disappears. RAM often holds crucial artifacts like running processes, open files, network connections, encryption keys, and unencrypted data that may not be written to persistent storage.
Go deeper
Related to this question
About these practice questions
One of 236 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.