ISC2 CC Security Operations Practice Question
During an incident, a responder needs to capture the contents of volatile memory on a running Linux server before shutting it down, because encryption keys and running processes may only exist in RAM. Which action BEST preserves this volatile evidence?
⚠ Common exam trap
The trap here is treating the disk image as the priority, when memory is more volatile and must be captured before shutdown or power loss.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Capture a memory image using a tool such as LiME or AVML before any shutdown
Order of volatility requires collecting the most perishable evidence first, and RAM contents disappear the moment a system loses power or restarts. Memory acquisition tools such as LiME or AVML capture encryption keys, active network connections, and running processes that disk images cannot recover. Capturing memory before shutdown or disk imaging preserves the ephemeral evidence needed to understand attacker activity and credentials in use.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Pull the power cord immediately, then remove and image the hard drive
Why it's wrong here
Cutting power destroys volatile memory contents, eliminating the encryption keys and process artifacts the responder needs. Although disk evidence survives, the most perishable evidence is gone. This approach also risks filesystem inconsistency. Order of volatility dictates capturing RAM before any action that removes power, so this method fails the investigative objective.
- ✗
Restart the server and enable verbose logging for future collection
Why it's wrong here
Restarting clears RAM and destroys exactly the volatile artifacts under investigation, while verbose logging only helps with future events, not the current incident. The responder's goal is to capture existing memory contents, not generate new logs. This action therefore irreversibly loses evidence and does not preserve anything relevant to the ongoing investigation.
- ✓
Capture a memory image using a tool such as LiME or AVML before any shutdown
Why this is correct
Memory acquisition tools like LiME and AVML dump RAM contents to a file or network location while the system runs, preserving encryption keys, network connections, and running processes that vanish on shutdown. Order of volatility principles require capturing memory before less volatile sources. Performing this first ensures the most perishable evidence is secured before power-off or disk imaging.
- ✗
Run the dd command to image the primary disk to an external drive
Why it's wrong here
Imaging the disk with dd preserves persistent storage contents, not volatile memory, and the disk already retains its data after shutdown. Encryption keys and process state in RAM would be lost. Additionally, writing a full disk image can take hours, during which volatile data may change, so this action does not best preserve the memory evidence needed.
Go deeper
Related to this question
Learn chapter
Network Security Foundations
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.