CISSP Security Operations Practice Question
A forensic investigator arrives at a crime scene involving a compromised server. The server is still running. According to the order of volatility, which of the following should the investigator capture FIRST?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CPU registers
CPU registers are the most volatile and must be captured first to preserve critical evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
RAM contents
Why it's wrong here
RAM (Random Access Memory) is highly volatile, meaning its contents are lost when power is removed or the system is rebooted. While critical for capturing active processes, open files, and cached data, it is generally considered less volatile than CPU registers. The data in RAM persists longer than the transient state held within CPU registers, making its capture a high priority, but secondary to the most immediately ephemeral data.
- ✓
CPU registers
Why this is correct
CPU registers represent the absolute most volatile data on a live system, holding the processor's current operational state, including instructions, memory addresses, and data actively being processed. Any interruption of power or even a context switch can instantly alter or erase this information. Capturing CPU registers first is paramount because they provide the most immediate and granular insight into what the system was doing at the precise moment of forensic interest, making them the highest priority in the order of volatility.
- ✗
Hard disk contents
Why it's wrong here
Hard disk contents are considered non-volatile storage, meaning the data persists even when the system loses power. This characteristic makes hard drives a lower priority for immediate capture at a live crime scene compared to volatile memory components. While crucial for long-term storage of files, operating system data, and user information, the data on a hard disk will not be lost simply by shutting down the system, allowing for a more deliberate and forensically sound acquisition process later.
- ✗
Network connections
Why it's wrong here
Network connections, including active sessions, open ports, and routing tables, represent volatile data that can change rapidly or be terminated. While important for understanding communication patterns and external interactions, they are generally less volatile than the CPU's internal state. The information related to network connections, such as active sockets or established sessions, can persist for some time, but capturing the CPU's immediate execution context is a higher priority because it directly reflects the system's current processing activity.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.