CS0-003 Incident Response and Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  RAM, CPU registers, disk, swap, logs, archived media

  Why it's wrong here

  This order incorrectly places RAM before CPU registers, but registers are the most volatile storage, holding transient data for the currently executing instruction and losing it immediately when power is cut. Additionally, it lists swap after disk, yet swap is a disk-backed paging file that is more volatile than persistent disk data because it is overwritten frequently and cleared on clean shutdown. The correct order demands registers first, then RAM, then swap, before reaching less volatile storage like disk.

• ✗

  Swap, RAM, CPU registers, disk, logs, archived media

  Why it's wrong here

  This sequence mistakenly leads with swap, which is a disk-based paging file that persists across reboots (though it may be cleared on clean shutdown), making it far less volatile than RAM and CPU registers. Placing swap before RAM and registers completely inverts the volatility hierarchy. Registers must come first, followed by RAM, then swap, then disk, logs, and archived media—this option has both the top and middle elements out of order.

• ✗

  Archived media, logs, disk, swap, RAM, CPU registers

  Why it's wrong here

  This is the exact reverse of the standard order of volatility, starting with archived media (the least volatile) and ending with CPU registers (the most volatile). Proper forensic practice requires collecting the most volatile data first to avoid losing ephemeral evidence, so registers must be captured before RAM, swap, disk, logs, or archived media. Reversing the order risks permanent loss of critical transient data, such as encryption keys or running processes, before they can be preserved.

• ✓

  CPU registers, RAM, swap, disk, logs, archived media

  Why this is correct

  This is the standard order of volatility used in digital forensics, ranking evidence by how quickly it is lost. CPU registers are the most volatile, holding the CPU's current working values and disappearing in nanoseconds; RAM follows, losing all data when power is removed; swap is a disk-backed file that may persist but is overwritten and purged; then disk, logs (which are written regularly but more durable), and finally archived media, which is deliberately preserved and least volatile. Following this order ensures the most fragile evidence is collected first.

Go deeper

Related to this question