mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: During a forensic investigation, the team needs…
During a forensic investigation, the team needs to preserve evidence from a running server. What is the FIRST step the team should take?
⚠ Common exam trap
Many exam-takers confuse the urgency of preserving volatile data with the desire to immediately isolate the system from the network, leading them to choose unplugging the network cable first, but the correct forensic priority is to capture the most volatile evidence (memory) before any network or power actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Capture a memory dump.
The first step in a forensic investigation of a running server is to capture a memory dump because volatile data (RAM) contains critical evidence such as running processes, network connections, encryption keys, and malware that would be lost if the system is powered off or altered. Preserving this volatile state before any other action ensures that the most transient evidence is secured, following the order of volatility principle. Capturing memory first prevents irreversible loss of data that cannot be recovered from disk or network captures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Capture a memory dump.
Why this is correct
Capturing a memory dump is the most critical initial step in preserving volatile evidence during a forensic investigation. This action secures data residing in RAM, such as active processes, network connections, open files, and potential malware artifacts that exist only in memory. Failure to capture a memory dump before power loss or system shutdown results in the irreversible loss of this highly volatile and often crucial forensic data, adhering to the principle of the order of volatility.
- ✗
Create a disk image.
Why it's wrong here
While creating a disk image is a crucial step for preserving persistent evidence, it is not the *first* action to take during an active forensic investigation. Disk imaging captures the state of non-volatile storage, such as hard drives, but does not address the highly volatile data residing in RAM. Performing a disk image before a memory dump risks losing critical in-memory artifacts and potentially altering the system state if the imaging tool itself writes to memory.
- ✗
Shut down the server normally.
Why it's wrong here
Shutting down the server normally is an incorrect action during a forensic investigation because it intentionally and irreversibly destroys all volatile data held in RAM. A graceful shutdown flushes buffers, terminates processes, and clears memory, eradicating critical evidence such as active network connections, running malware, open files, and user session data. This action fundamentally alters the system's state, making it impossible to reconstruct the live environment.
- ✗
Unplug the network cable.
Why it's wrong here
Unplugging the network cable can be a necessary step to isolate a compromised system and prevent further remote tampering or data exfiltration. However, it is not the primary action for *preserving* evidence, especially volatile memory. This action does not capture any in-memory artifacts and, if followed by an immediate power-off, still results in the complete loss of all volatile data, failing to adhere to the principle of collecting the most volatile evidence first.
Go deeper
Related to this question
Learn chapter
Asset Security: Privacy and Data Retention
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.