GCFA Enterprise Environment Incident Response Practice Question
An organization is responding to a ransomware incident. The attackers encrypted files on several servers and left a ransom note. Which immediate action should the incident response team take to preserve the most volatile evidence before shutting down the affected systems?
⚠ Common exam trap
The trap here is prioritizing containment or disk imaging over volatile data collection, which can result in the permanent loss of memory-resident evidence like encryption keys.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Collect volatile data such as memory and network connections.
The order of volatility dictates that the most volatile evidence, such as memory and network connections, should be collected first. In a ransomware incident, memory can contain encryption keys and indicators of compromise that are crucial for response and recovery. Disk imaging and containment actions can be performed afterward without losing this critical data. Interviews are non-technical and can be done at any time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Interview system administrators about the ransomware note.
Why it's wrong here
Interviewing administrators is useful for understanding the incident, but it does not preserve volatile evidence. The ransom note is non-volatile and remains on disk. The immediate priority is to capture volatile data before it is lost. Interviews can be conducted later without risking evidence destruction, whereas volatile data cannot be recovered once the system is powered off.
- ✓
Collect volatile data such as memory and network connections.
Why this is correct
Volatile data like memory contents, network connections, and running processes can be lost when a system is powered off. In a ransomware incident, memory may contain encryption keys, command-and-control connections, and other actionable intelligence. Collecting this data first follows the order of volatility and ensures critical evidence is preserved before any shutdown or disk imaging.
- ✗
Disconnect the servers from the network to prevent further spread.
Why it's wrong here
Disconnecting from the network is a containment step that may be necessary, but it can also destroy volatile network connection data. If done before capturing volatile evidence, it would eliminate the ability to identify active command-and-control channels or lateral movement. The order of volatility dictates that volatile data should be collected before containment actions that alter the system state.
- ✗
Capture a forensic image of the disk drives.
Why it's wrong here
Capturing a disk image is important, but disk drives are non-volatile. The most volatile evidence, such as memory and network connections, would be lost if the system is shut down or if only disk imaging is performed. Disk imaging should be done after volatile data is collected, as shutting down the system to image disks could destroy volatile evidence like running processes and encryption keys in memory.
About these practice questions
This GCFA question is part of Courseiva's 292-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.