ISC2 CC Business Continuity, DR & Incident Response Practice Question
During an incident, an organization needs to preserve volatile data. Which of the following should be collected FIRST?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Memory contents
Volatile data is lost when the system loses power. Memory content is the most volatile.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Backup tapes
Why it's wrong here
Backup tapes are offline, persistent media that remain intact for long periods, so they are among the least volatile sources. They are tempting as a convenient historical record, but order of volatility requires seizing memory and other transient state before archived media.
- ✓
Memory contents
Why this is correct
Memory contents are the most volatile, lost on power-off or reboot, so they must be captured before disk or logs. Order of volatility dictates collecting RAM first to preserve evidence such as running processes and encryption keys.
- ✗
Hard drive contents
Why it's wrong here
Hard drive contents persist after power loss, making them less volatile than memory, cache or running processes. They are tempting because they hold the bulk of forensic artefacts, yet order of volatility dictates capturing RAM-resident data before disk imaging.
- ✗
Network logs
Why it's wrong here
Network logs reside on disk and survive a reboot, so they are not the most volatile evidence and can be gathered after memory-resident data. They are tempting because they often hold the intrusion trail, but order of volatility requires capturing RAM and running processes first.
Go deeper
Related to this question
Learn chapter
Incident Response and Management
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.