hardMultiple ChoiceObjective-mapped
CISM Practice Question: During a forensic investigation, an incident…
During a forensic investigation, an incident responder needs to collect memory from a compromised server. What is the BEST method to preserve evidence integrity?
⚠ Common exam trap
It's easy for candidates to choose a remote or network-based method (Options A or B) thinking it is 'live' and 'non-disruptive,' but they overlook the fundamental forensic principle that volatile memory must be captured without altering the system state, which network-based methods inherently fail to guarantee.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Perform a hardware memory acquisition using a write-blocker.
Hardware memory acquisition using a write-blocker ensures that the forensic tool accesses the physical memory (RAM) directly without any modification to the system's storage or memory contents. This method preserves the integrity of the evidence by preventing any writes to the original media, which is critical for maintaining a verifiable chain of custody and admissibility in legal proceedings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remotely acquire memory using a network connection.
Why it's wrong here
Network traffic may alter memory state.
- ✗
Use a live forensic toolkit to capture memory to a network share.
Why it's wrong here
Writing over network may change memory content.
- ✗
Reboot the system into safe mode and then capture memory.
Why it's wrong here
Rebooting destroys volatile evidence.
- ✓
Perform a hardware memory acquisition using a write-blocker.
Why this is correct
Ensures data integrity and volatile data preservation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.