CND Practice Question: Incident Detection Response And Threat Prediction
A security analyst is investigating a suspected malware outbreak on a domain controller. To ensure forensic integrity and maintain a proper chain of custody before powering down the machine, what is the correct sequence of volatility when acquiring volatile evidence using live response tools such as FTK Imager or LiME?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CPU registers and cache, routing tables and network connections, system memory (RAM), hard disk storage
When collecting volatile digital evidence, Order of Volatility dictates that analysts must capture data from the most volatile storage locations to the least volatile. RAM and CPU registers disappear upon power down, whereas disk storage persists. Therefore, network connections and running processes must be captured before system memory dumps, and physical disk storage is collected last.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Running processes, hard disk storage, system memory (RAM), CPU registers
Why it's wrong here
This incorrectly places persistent hard disk storage ahead of highly volatile RAM and CPU registers.
- ✓
CPU registers and cache, routing tables and network connections, system memory (RAM), hard disk storage
Why this is correct
CPU registers and cache are the most volatile, followed by network connections/routing tables, system memory, and finally non-volatile hard disk storage.
- ✗
Hard disk image, system memory (RAM), network connections, running processes
Why it's wrong here
This order is completely inverted regarding volatility, leading to the loss of volatile state information.
- ✗
System memory (RAM), hard disk storage, running processes, CPU registers
Why it's wrong here
Hard disk storage is non-volatile and should be captured after highly volatile memory and process states.
About these practice questions
This CND question is part of Courseiva's 323-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CND practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CND exam.