SSCP Incident Response and Recovery Practice Question
An incident responder is collecting evidence from a compromised server. Which of the following is the correct order for collecting volatile data?
⚠ Common exam trap
ISC2 often tests the misconception that disk imaging should be done first because it is the most stable evidence source, but the trap is that volatile data such as network state and memory is lost forever if not captured immediately. Note that network connections are more volatile than RAM and must be collected before the memory dump.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network connections, memory dump, disk image
Volatile data must be collected in order of decreasing volatility. Network connections (active sessions, ARP cache, routing tables) are more volatile than RAM and can change or disappear within seconds, so they are captured first. Memory (RAM) is collected next because it is lost on power loss but persists slightly longer than network state. The disk image is collected last because it is persistent storage and the least volatile. This order preserves ephemeral evidence such as active sessions, running processes, and encryption keys before it disappears.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Network connections, memory dump, disk image
Why this is correct
Memory is more volatile than network connections, so it should be first.
- ✗
Disk image, network connections, memory dump
Why it's wrong here
This reverses the order of volatility.
- ✗
Memory dump, network connections, disk image
Why it's wrong here
Memory is the most volatile and is lost on power-off, so it must be captured first. Network connections are also volatile but persist briefly, so they follow. A disk image is non-volatile and can be collected last without losing state.
- ✗
Disk image, memory dump, network connections
Why it's wrong here
Memory should be collected before disk because it is more volatile.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.