How to Preserve Transient Information Before Shutdown or Imaging?
During malware containment, an analyst needs to preserve transient information from a compromised Windows workstation that is still running. Which action is MOST appropriate before shutdown or imaging?
Quick Answer
The answer is to capture memory and live process information with approved response tools. This is correct because transient information, such as running processes, active network connections, and memory-resident malware, is lost the moment the system is powered off or imaged after a hard shutdown. The order of volatility, defined in RFC 3227, dictates that volatile evidence like RAM must be collected first, as it disappears when the system loses power. On the Security+ SY0-701 exam, this concept tests your understanding of incident response procedures, specifically the preservation of volatile evidence before shutdown or imaging during malware containment. A common trap is choosing to immediately pull the plug or perform a disk image, which destroys the very data needed for attribution and root-cause analysis. Remember the mnemonic “RAM before ROM” — always grab the most volatile data first, because once the power goes, the evidence goes with it.
⚠ Common exam trap
Candidates often think immediate power-off preserves evidence, but it actually destroys volatile data, which is the most time-sensitive and valuable for incident response.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Capture memory and live process information with approved response tools
Transient information such as running processes, network connections, and memory-resident malware is lost when the system is powered off. Capturing memory and live process data with approved forensic tools (e.g., FTK Imager, DumpIt, or WinPmem) preserves volatile evidence critical for incident analysis and attribution, in accordance with the order of volatility (RFC 3227).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Capture memory and live process information with approved response tools
Why this is correct
Live memory and process data can disappear on shutdown, so capturing them preserves valuable forensic evidence.
- ✗
Immediately unplug the workstation and carry it to the evidence room
Why it's wrong here
Pulling power abruptly can lose volatile data and does not preserve the running system state.
- ✗
Run a full antivirus scan to clean the machine before analysis
Why it's wrong here
Cleaning first can change or destroy evidence and makes later forensic reconstruction less reliable.
- ✗
Clear the event logs so the malicious activity is easier to isolate
Why it's wrong here
Clearing logs destroys evidence and prevents investigators from reconstructing the timeline accurately.
Go deeper
Related to this question
Learn chapter
Incident Response Process
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst detects real-time data exfiltration from a critical production database that supports customer transactions. The exfiltration appears to be occurring via a compromised application service account. Which containment strategy should the analyst implement FIRST to minimize damage while preserving forensic data?
medium- ✓ A.Disconnect the database server from the network.
- B.Shut down the database server.
- C.Implement network segmentation to isolate the server.
- D.Block the IP address of the suspected attacker.
Why A: Disconnecting the database server from the network (Option A) immediately stops the active data exfiltration by severing all network communication, including the compromised service account's outbound connections. This preserves the server's volatile memory, running processes, and disk state for forensic analysis, unlike a shutdown which would destroy critical evidence. It is the fastest containment action that minimizes data loss while maintaining the integrity of forensic artifacts.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.