hardMultiple Choice
ISC2 CC Practice Question: A forensic analyst responding to a reported…
You are a forensic analyst responding to a reported compromise of a Linux web server. The server hosts a public-facing web application and is part of a DMZ. The initial investigation shows that unauthorized outbound connections were made to a known malicious IP address during the previous night. The server is still running and connected to the network, but the web application has been taken offline for maintenance. The incident response team wants to preserve evidence for potential legal action. You have a forensic workstation with tools like dd, netcat, and memory acquisition tools. Which of the following should be your FIRST step in the forensic acquisition process?
⚠ Common exam trap
ISC2 often tests the 'order of volatility' principle, and the trap here is that candidates mistakenly prioritize disk imaging (Option A) because it is a familiar step, ignoring that RAM holds the most ephemeral and critical evidence.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Capture the contents of volatile memory (RAM) using a memory acquisition tool.
Volatile memory (RAM) contains critical evidence such as running processes, network connections, encryption keys, and in-memory malware that would be lost when the system is powered off. In a forensic response, the order of volatility dictates that RAM must be captured first before any non-volatile data. Option D is correct because it follows the established forensic principle of preserving the most volatile data first.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a bit-for-bit copy of the hard drive using dd and a write blocker.
Why it's wrong here
Imaging the drive first discards volatile RAM holding running processes, network sockets and injected code, and dd on a live mounted disk captures inconsistent data. Disk imaging is right once memory is preserved and the host is isolated; here the still-running server demands memory capture before power-down.
- ✗
Capture network traffic from the server for analysis.
Why it's wrong here
Capturing network traffic now records only ongoing sessions, not the previous night's outbound connections to the malicious IP, and it consumes time while RAM decays. Traffic capture suits monitoring live intrusions; this scenario requires volatile memory first because the evidence of interest already occurred.
- ✗
Run a full antivirus scan to identify malware.
Why it's wrong here
An antivirus scan writes to the disk, alters file timestamps and may quarantine artefacts, contaminating evidence intended for legal action. Scanning is appropriate for cleaning an infected host after acquisition; here it must follow memory capture and imaging, since preservation precedes remediation.
- ✓
Capture the contents of volatile memory (RAM) using a memory acquisition tool.
Why this is correct
RAM holds running processes, network connections and encryption keys that vanish on power-off, so capturing it first preserves volatile evidence the malicious outbound sessions left behind. Disk imaging can follow afterwards without losing this data, satisfying the legal preservation requirement.
Go deeper
Related to this question
Learn chapter
Network Security Components and Controls
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.