mediumMultiple ChoiceObjective-mapped
CS0-003 Practice Question: During incident response, a team isolates a host…
During incident response, a team isolates a host but needs to preserve volatile evidence. What should be done first?
⚠ Common exam trap
CompTIA often tests the order of volatility (OOV) by making candidates think network isolation is the immediate priority, but the trap is that volatile memory must be captured first because network state is part of that volatile data and disconnecting the network changes the system's state before evidence is collected.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Capture a memory dump
When a host is isolated during incident response, the first priority is to capture volatile data before it is lost. A memory dump preserves the contents of RAM, which includes running processes, network connections, open files, and encryption keys. This data is critical for forensic analysis and disappears when the system is powered off. Disconnecting the network (option B) is important but should follow memory capture because network activity is part of the volatile state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Capture a memory dump
Why this is correct
Capturing a memory dump is the critical next step after isolating a host because it preserves volatile data residing in RAM. This data, which includes running processes, network connections, open files, and potentially malware artifacts, would be lost upon system shutdown or reboot. Analyzing a memory dump provides invaluable forensic evidence for understanding the attacker's activities and the extent of the compromise without altering the live system state.
- ✗
Disconnect from the network
Why it's wrong here
Disconnecting the host from the network is a crucial step for isolation, preventing further compromise or data exfiltration. However, if performed *before* capturing a memory dump, it can lead to the loss of certain volatile network-related artifacts, such as active connections or open network shares, that were present in RAM. While isolation is necessary, preserving the most ephemeral evidence takes precedence immediately after initial containment.
- ✗
Reimage the hard drive
Why it's wrong here
Reimaging the hard drive is an inappropriate action during the initial stages of incident response because it completely destroys all forensic evidence on the disk. This process overwrites the operating system, user data, and any malware artifacts, making it impossible to conduct a thorough investigation into the breach's root cause, scope, or impact. Reimaging is typically a remediation step performed much later, after all necessary evidence has been preserved and analyzed.
- ✗
Reboot the system
Why it's wrong here
Rebooting the system is highly detrimental during incident response as it irrevocably destroys all volatile data stored in RAM. This includes critical forensic artifacts such as active processes, network connections, open files, and any malware running solely in memory. Furthermore, a reboot can alter timestamps, clear logs, and potentially trigger anti-forensic mechanisms or destroy temporary files, hindering a comprehensive investigation.
Go deeper
Related to this question
Learn chapter
SIEM Log Analysis
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
Memory capture
Memory capture is the process of preserving the contents of a computer's volatile memory (RAM) for forensic analysis during incident response.
About these practice questions
One of 236 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.