CS0-003 Incident Response and Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Swap, RAM, CPU registers, disk, logs

  Why it's wrong here

  This sequence incorrectly places swap space and system RAM before CPU registers. CPU registers and cache memory are the most volatile components in a system because their state changes within nanoseconds and is lost instantly upon power loss. Swap space, being a portion of virtual memory stored on a physical storage drive, is far less volatile than both CPU registers and physical RAM.

• ✗

  Disk, RAM, swap, CPU registers, logs

  Why it's wrong here

  This order incorrectly positions physical disk storage as the most volatile asset, followed by RAM and CPU registers. In digital forensics, physical disks are considered highly persistent storage media that retain data without power, whereas CPU registers and RAM are highly volatile and lose data immediately when power is cut. This sequence completely reverses the standard order of volatility.

• ✗

  RAM, CPU registers, swap, disk, logs

  Why it's wrong here

  This option incorrectly prioritizes system RAM over CPU registers. While RAM is highly volatile and must be captured early in an investigation, CPU registers and cache hold active execution states that change at the processor's clock speed, making them significantly more volatile than system memory. Forensics professionals must capture CPU states before dumping RAM to prevent overwriting critical execution data.

• ✓

  CPU registers, RAM, swap, disk, logs

  Why this is correct

  This sequence accurately represents the descending order of volatility according to RFC 3227 guidelines. CPU registers and cache are the most transient, followed by system RAM, then swap/paging files, local hard disks, and finally remote or archived logs. Following this order during an incident response ensures that the most fragile, short-lived digital evidence is preserved before it is overwritten by system processes or power loss.

Go deeper

Related to this question