CISSP Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  CPU registers → Cache → RAM → Swap → Disk → Remote logging → Physical media

  Why this is correct

  This sequence accurately represents the order of volatility for digital evidence, moving from the most volatile to the least volatile. CPU registers hold data directly processed by the CPU and are lost almost instantly upon power loss. Cache memory, while faster than RAM, is also volatile and stores frequently accessed data for quick retrieval. RAM (Random Access Memory) is volatile main memory, followed by swap space on disk, which is less volatile but still dynamic. Disk storage, remote logging, and physical media like backup tapes represent progressively less volatile forms of data, retaining information even after system shutdown, making this the correct acquisition order.

• ✗

  Physical media → Remote logging → Disk → Swap → RAM → Cache → CPU registers

  Why it's wrong here

  This sequence incorrectly reverses the order of volatility, starting with the least volatile data sources and ending with the most volatile. Physical media, such as backup tapes or external hard drives, represents the least volatile data, designed for long-term retention and stability. Conversely, CPU registers are the most volatile, holding data only while the CPU is actively processing it and being erased immediately upon power interruption. A proper forensic acquisition strategy prioritizes capturing the most ephemeral data first to prevent its irreversible loss, making this reversed order fundamentally flawed.

• ✗

  Cache → CPU registers → RAM → Swap → Remote logging → Disk → Physical media

  Why it's wrong here

  This sequence is incorrect because it misplaces cache memory before CPU registers in terms of volatility. CPU registers are the absolute most volatile data source, holding data directly within the processor for immediate operations and being lost instantaneously with power disruption. Cache memory, while extremely fast and volatile, serves as a buffer for the CPU and is slightly less volatile than the registers themselves, making its placement here inaccurate for a proper order of acquisition. The correct approach demands capturing registers before cache to preserve the most transient evidence.

• ✗

  RAM → CPU registers → Cache → Swap → Disk → Remote logging → Physical media

  Why it's wrong here

  This sequence is incorrect because it places RAM before both CPU registers and cache memory, which are significantly more volatile. CPU registers are the most ephemeral data, directly followed by cache, which acts as a high-speed buffer for the CPU. RAM, while volatile, retains data for a longer duration than registers or cache during active system operation and is typically acquired after these more transient components. Forensic acquisition must prioritize the capture of CPU registers and cache before RAM to ensure the preservation of the most transient and critical evidence.

Go deeper

Related to this question