A security analyst is responding to a potential ransomware incident on a Windows server that is still running. The analyst needs to preserve forensic evidence for analysis. Which of the following actions should the analyst perform first, based on the order of volatility?

Shut down the server to prevent further damage

Incorrect. Shutting down the server destroys volatile memory data and may also trigger anti-forensic behavior from malware. Forensic best practice is to capture volatile data before powering off.

Create a forensic disk image of the hard drive

Incorrect. While disk imaging is important, it is less urgent than capturing volatile data because disk contents persist even after shutdown. Disk imaging should be performed after memory capture.

Run a full antivirus scan on the system

Incorrect. Running an antivirus scan modifies the system state (e.g., by accessing files, creating logs, or quarantining malware) and can destroy volatile evidence. Scanning should be performed on a forensic copy, not the live system.

What does this SY0-701 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Capture a full memory dump of the server — The order of volatility (OOV) dictates that the most volatile data (data that changes rapidly or is lost when power is removed) should be captured first. Memory (RAM) is the most volatile because it contains running processes, network connections, and encryption keys that disappear when the system is shut down or rebooted. Capturing a memory image before any other action ensures that this critical evidence is preserved. Disks contain persistent data but are less volatile, while shutting down the system would destroy volatile data. Running an antivirus scan alters the system state and can destroy evidence.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.