CISSP Security Operations Practice Question
During a digital forensics investigation, which of the following data sources has the highest order of volatility?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CPU registers
CPU registers hold the most volatile data, followed by cache, RAM, swap, disk, remote logging, and physical media.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
CPU registers
Why this is correct
CPU registers represent the absolute highest level of data volatility in a system. These tiny, high-speed storage locations are integral to the CPU's operation, holding data and instructions actively being processed. Their contents are transient, changing with every clock cycle and being completely lost the moment power is interrupted or the operating system performs a context switch, making them critical to capture first in a forensic investigation.
- ✗
Remote logging server
Why it's wrong here
A remote logging server stores event data that has been transmitted from the target system. While the transmission of these logs might involve volatile network buffers, the logs themselves, once received and written to storage on the remote server, become persistent data. This makes them significantly less volatile than CPU registers, as they are not directly tied to the immediate operational state or power status of the originating system.
- ✗
Network packets in transit
Why it's wrong here
Network packets in transit are inherently volatile because they exist temporarily in network buffers, switches, and routers as they move across a network. If not captured immediately, they are lost as they reach their destination or are dropped. However, their volatility is generally lower than that of CPU registers, which are directly tied to the CPU's active processing state and change or disappear far more rapidly and completely with any system state alteration.
- ✗
Hard disk drive
Why it's wrong here
A hard disk drive (HDD) is a classic example of non-volatile storage. Data written to an HDD is magnetically encoded onto platters and remains persistent even when power is removed from the system. This characteristic places it at the very bottom of the order of volatility, meaning its contents are far less susceptible to loss or alteration compared to dynamic memory, network buffers, or especially CPU registers during a forensic incident.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.