CND Practice Question: Incident Detection Response And Threat Prediction
An organization is establishing forensic readiness for critical database servers. Which technical control directly supports forensic readiness by ensuring volatile RAM contents can be preserved during a suspected live kernel attack?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ensuring kernel crash dumps are enabled and a trusted memory acquisition utility like LiME is pre-staged
Pre-installed memory acquisition tools or kernel crash dump configurations enable capturing volatile RAM before a reboot.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Ensuring kernel crash dumps are enabled and a trusted memory acquisition utility like LiME is pre-staged
Why this is correct
Pre-staging memory acquisition ensures volatile system state can be captured forensically.
- ✗
Configuring automatic disk encryption using BitLocker with a TPM chip
Why it's wrong here
Disk encryption protects data at rest against physical theft, but hinders live memory acquisition unless handled properly.
- ✗
Deploying a Host-Based Intrusion Detection System (HIDS) for file integrity monitoring
Why it's wrong here
HIDS monitors static file systems, not volatile RAM.
- ✗
Enabling centralized syslog forwarding over encrypted TLS channels
Why it's wrong here
Syslog forwards log events, not memory states.
About these practice questions
One of 323 original CND practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CND practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CND exam.