SSCP Incident Response and Recovery Practice Question
A security analyst is responding to a confirmed malware infection on a Windows workstation. The workstation is still powered on and connected to the corporate network. The analyst needs to collect volatile data that could be lost if the system is shut down or the malware is allowed to continue running. Which TWO of the following data sources should the analyst prioritize for collection? (Choose two.)
⚠ Common exam trap
A common mix-up: candidates confuse important disk-based artifacts, such as registry hives or event logs, with volatile data that disappears when the system is powered off.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Active network connections and associated process IDs.
The two most volatile data sources are RAM contents and active network connections with process IDs. Both are lost when the system is powered off or the malware terminates its connections. Registry hives, MFT, and event logs are stored on disk and persist, so they can be collected later. Prioritizing volatile data aligns with the order of volatility in incident response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Event logs stored in the C:\Windows\System32\winevt\Logs directory.
Why it's wrong here
Event logs are written to disk and persist across reboots. Although they are important for investigations, they are not volatile and will not be lost if the system is shut down. The analyst can collect them later from the disk or a forensic image. Prioritizing volatile data like RAM and active network connections is more time-sensitive because those artifacts disappear quickly.
- ✓
Active network connections and associated process IDs.
Why this is correct
Active network connections and their associated process IDs are volatile and can reveal command-and-control (C2) communications or data exfiltration. This information is lost when the system is shut down or the connection is terminated. Collecting it early helps identify the malware's external infrastructure and affected processes. Tools like netstat and Get-NetTCPConnection can capture this data quickly.
- ✗
The master file table (MFT) on the NTFS volume.
Why it's wrong here
The MFT is a disk-based structure that records file metadata and is non-volatile. It remains intact after shutdown and can be analyzed later from a forensic image. While it can show file creation and modification times, it is not lost when the system powers off. Thus, it is not a priority for volatile data collection compared to memory or active network connections.
- ✗
The Windows Registry hive files stored on the hard drive.
Why it's wrong here
Registry hive files are stored on disk and are non-volatile; they persist after shutdown. While they are valuable for understanding configuration and persistence, they are not lost if the system is powered off. Therefore, they are not a priority for volatile data collection. The analyst should focus on data that will disappear, such as memory contents, before collecting disk-based artifacts.
- ✓
Contents of the system's RAM, including running processes and network connections.
Why this is correct
RAM contains volatile data such as running processes, open network connections, and potentially encryption keys or malware in memory. This information is lost when the system is powered off or rebooted. Collecting a memory image is a critical step in incident response to understand the malware's behavior and persistence mechanisms. It should be prioritized before any actions that might alter the system state.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.