easyMultiple ChoiceObjective-mapped
CISM Practice Question: During an incident investigation, the incident…
During an incident investigation, the incident response team needs to collect volatile data from a compromised server. Which of the following data should be collected FIRST?
⚠ Common exam trap
The trap here is that candidates often prioritize persistent data like hard drive contents or logs, mistakenly thinking they are more important, but the order of volatility dictates that transient data in RAM must be captured first to avoid permanent loss.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Contents of system memory (RAM)
Volatile data, such as the contents of system memory (RAM), is lost when the system is powered off. Collecting RAM first preserves evidence of running processes, network connections, and encryption keys that would otherwise be destroyed. This follows the order of volatility (RFC 3227), which mandates capturing the most volatile data first.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Contents of system memory (RAM)
Why this is correct
Memory is the most volatile and should be captured first.
- ✗
Network connection logs from the firewall
Why it's wrong here
Firewall logs are external and not volatile.
- ✗
Contents of the hard drive
Why it's wrong here
Collecting hard drive contents is a disk imaging step that requires the system to be powered off, which destroys the volatile data in RAM, network connections, and running processes that the incident response team must capture first to preserve evidence of active compromise. This option is tempting because forensic analysts routinely image drives for persistent malware and file-based artefacts, and in a post-incident forensic examination where the system is already offline, imaging the hard drive would be the correct initial step.
- ✗
Event logs from the system
Why it's wrong here
Event logs are stored on disk and less volatile.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISM
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During an incident, the response team collects volatile data from a compromised server. Which of the following should be collected FIRST to minimize loss of evidence?
medium- ✓ A.Contents of RAM
- B.Contents of hard drive
- C.Event logs
- D.Network configuration
Why A: Volatile data, such as the contents of RAM, is lost when a system is powered off. The first priority during incident response is to capture this data because it contains running processes, network connections, encryption keys, and malware that exist only in memory. Collecting RAM first ensures that this critical evidence is preserved before any other actions that might alter the system state.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.