CISSP Security Operations Practice Question
During a digital forensics investigation, which of the following data sources has the highest order of volatility?
⚠ Common exam trap
The trap is confusing 'network packets in transit' as highly volatile — they are volatile, but CPU registers are at the very top of the RFC 3227 order, and candidates often overlook registers in favor of more familiar network data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CPU registers
CPU registers have the highest order of volatility because they hold the most transient data — values change with every instruction cycle and are lost when power is removed or the process is context-switched. In digital forensics, the order of volatility (RFC 3227) dictates that you collect the most volatile data first, starting with CPU registers and cache, then memory, then network state, then disk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
CPU registers
Why this is correct
CPU registers represent the absolute highest level of data volatility in a system. These tiny, high-speed storage locations are integral to the CPU's operation, holding data and instructions actively being processed. Their contents are transient, changing with every clock cycle and being completely lost the moment power is interrupted or the operating system performs a context switch, making them critical to capture first in a forensic investigation.
- ✗
Remote logging server
Why it's wrong here
A remote logging server stores event data that has been transmitted from the target system. While the transmission of these logs might involve volatile network buffers, the logs themselves, once received and written to storage on the remote server, become persistent data. This makes them significantly less volatile than CPU registers, as they are not directly tied to the immediate operational state or power status of the originating system.
- ✗
Network packets in transit
Why it's wrong here
Network packets in transit are inherently volatile because they exist temporarily in network buffers, switches, and routers as they move across a network. If not captured immediately, they are lost as they reach their destination or are dropped. However, their volatility is generally lower than that of CPU registers, which are directly tied to the CPU's active processing state and change or disappear far more rapidly and completely with any system state alteration.
- ✗
Hard disk drive
Why it's wrong here
A hard disk drive (HDD) is a classic example of non-volatile storage. Data written to an HDD is magnetically encoded onto platters and remains persistent even when power is removed from the system. This characteristic places it at the very bottom of the order of volatility, meaning its contents are far less susceptible to loss or alteration compared to dynamic memory, network buffers, or especially CPU registers during a forensic incident.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.