hardMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: During a forensic investigation, an analyst…
During a forensic investigation, an analyst acquires a live system memory dump. Which tool is most appropriate for capturing the contents of volatile memory on a Windows system?
⚠ Common exam trap
ISC2 often tests the distinction between tools for capturing volatile memory versus non-volatile storage, and candidates may mistakenly choose FTK Imager because it is a well-known forensic suite, but it is not the primary tool for live memory acquisition on Windows.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DumpIt
DumpIt is a lightweight, standalone tool designed specifically for capturing the full contents of volatile memory (RAM) on a Windows system. It creates a raw memory dump file without requiring installation or complex configuration, making it ideal for forensic acquisition of live system memory.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DumpIt
Why this is correct
DumpIt is designed specifically for capturing volatile memory on Windows systems.
- ✗
Wireshark
Why it's wrong here
Wireshark is a network protocol analyzer, not a memory acquisition tool.
- ✗
FTK Imager
Why it's wrong here
FTK Imager is primarily designed for creating forensic images of physical drives, logical volumes, and individual files, not for acquiring a full live system memory dump. While it can capture some volatile artefacts like the Windows registry files, it lacks the specific functionality to extract the entire contents of RAM. This option is tempting because FTK Imager is a widely recognised tool for forensic data acquisition, and would be the correct choice for imaging a suspect's hard drive or creating logical file images during an investigation.
- ✗
dd
Why it's wrong here
dd is used for bit-for-bit disk imaging, not memory.
Go deeper
Related to this question
About these practice questions
One of 976 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.