CISSP Security Operations Practice Question
During a forensic investigation, an analyst must collect volatile data in the correct order. Which of the following sequences correctly follows the order of volatility?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CPU registers → cache → RAM → swap → disk
The order of volatility prioritizes collecting data from most volatile to least volatile to avoid loss.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
CPU registers → cache → RAM → swap → disk
Why this is correct
This sequence accurately represents the decreasing order of volatility for digital evidence, which is crucial for forensic collection. CPU registers are the most volatile, holding data only during active processing and being lost immediately upon power loss or context switch. Cache memory is slightly less volatile but still transient, followed by RAM, which requires continuous power to retain data. Swap space, residing on disk, is less volatile than RAM but more dynamic than persistent disk storage, making disk the least volatile and most persistent data source.
- ✗
Disk → RAM → CPU registers → cache → swap
Why it's wrong here
This option incorrectly prioritizes the collection of evidence by starting with the least volatile data source, the disk. Forensic best practices dictate collecting the most volatile evidence first to prevent its loss, as data in CPU registers and cache is highly transient and would likely be overwritten or disappear before disk acquisition could even begin. Acquiring disk data before RAM or CPU state risks losing critical real-time system information that could be vital to the investigation.
- ✗
RAM → CPU registers → swap → disk → remote logging
Why it's wrong here
This sequence is incorrect because it places RAM before CPU registers in the collection order. CPU registers are significantly more volatile than RAM, holding data that changes with every clock cycle and is lost instantly upon power interruption or process termination. Collecting RAM before registers risks losing crucial, real-time processing state information. Additionally, while remote logging is important, it represents an external, often persistent, data source and doesn't fit neatly into the system's internal memory hierarchy of volatility.
- ✗
Swap → RAM → cache → CPU registers → disk
Why it's wrong here
This option presents a largely reversed order of volatility, which is fundamentally flawed for forensic evidence collection. Starting with swap space, which is less volatile than RAM, cache, or CPU registers, means that the most transient and critical in-memory data would likely be lost or corrupted before collection could occur. The principle of forensic collection demands securing the most ephemeral data first to preserve its integrity and evidentiary value, which this sequence fails to do.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.