GSEC Incident Handling and Response Practice Question
A responder is preparing to image a compromised Windows server's memory before shutting it down. The server hosts a critical database and management insists on minimal downtime. Which action best preserves the most volatile evidence while respecting the operational constraint?
⚠ Common exam trap
The trap here is assuming that shutting down quickly is always the safest containment step, when it actually destroys the most volatile and often most valuable evidence.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Capture a full physical memory dump using a trusted tool, then proceed with containment and shutdown.
The order of volatility dictates that the most perishable evidence, such as RAM contents, be collected first. A physical memory dump captures running processes, network connections, and in-memory-only malware before containment actions alter or destroy them. Once memory is secured, the responder can contain and shut down the server, satisfying both forensic integrity and the operational requirement to minimize downtime.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disconnect the server from the network, then capture memory after confirming no active sessions remain.
Why it's wrong here
Disconnecting the network preserves some evidence but, more importantly, the delay while confirming no active sessions allows memory-resident artifacts to change or be lost. Memory capture should occur before significant state changes. Waiting reduces the fidelity of the volatile data and risks the adversary or normal processes overwriting the very artifacts the responder needs.
- ✓
Capture a full physical memory dump using a trusted tool, then proceed with containment and shutdown.
Why this is correct
Physical memory is the most volatile evidence and contains running processes, network connections, and injected code that vanish on shutdown. Capturing it first with a trusted, forensically sound tool satisfies the order of volatility while allowing containment afterward. This balances evidentiary integrity with the operational need to limit downtime, making it the best action in this scenario.
- ✗
Shut down the server immediately to prevent lateral movement, then image the disk on a write blocker.
Why it's wrong here
Shutting down destroys volatile memory, including active network connections, decrypted keys, and in-memory malware. Disk imaging on a write blocker preserves persistent data but cannot recover what was only in RAM. Because the scenario specifically asks to preserve the most volatile evidence, an immediate shutdown contradicts the order of volatility and loses critical artifacts.
- ✗
Run a full antivirus scan and collect the resulting log before capturing memory.
Why it's wrong here
Running an antivirus scan modifies the system state and can delete or quarantine artifacts, contaminating evidence. It also consumes time and may trigger adversary anti-forensic behavior. The scan output is not a substitute for a raw memory image, and performing it first violates the principle of capturing the most volatile data before less volatile sources.
About these practice questions
One of 351 original GSEC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GSEC practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GSEC exam.