312-39 Forensic Investigation And Malware Analysis Practice Question

Which TWO types of evidence are classified as 'volatile' and should be captured first during a forensic investigation?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Active network connections

Volatile data is lost when power is removed, making it the highest priority for collection.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Browser history files
Why it's wrong here
These are saved to disk, so they are non-volatile.
✗
Registry hive files on disk
Why it's wrong here
These are stored on disk and are non-volatile.
✓
Active network connections
Why this is correct
Connections are lost as soon as the process terminates or the system powers down.
✗
Hard drive partition table
Why it's wrong here
This is non-volatile data.
✓
System RAM contents
Why this is correct
RAM is highly volatile and lost on reboot.

About these practice questions

Courseiva writes every 312-39 question from scratch — 201 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Written and reviewed by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Last reviewed August 2026 · checked against the official EC-Council exam blueprint

Ready to practise?

Put this into practice with a full scored session.

Start practice session

Practice tests

Quick scored rounds with instant marking and a written explanation per question.

312-39 Practice Test 1 — 25 Questions→312-39 Practice Exam 3 — 20 Questions→

Practice by domain

Each domain maps to a weighted exam section. Focus on the domain where you are weakest.

Forensic Investigation And Malware Analysis SOC For Cloud Environments Cyber Threats Iocs And Attack Methodology

Filter by question format

Pick a question style and work only that format until it feels routine.

Browse scenarios

Practice by topic

Each topic page collects the questions that test one concept, plus the theory behind it.

Forensic Investigation And Malware Analysis practice questions Cyber Threats Iocs And Attack Methodology practice questions Proactive Threat Detection practice questions

Continue studying

Exam domains All 312-39 questions Study guide

This 312-39 practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 312-39 exam.