SSCP Incident Response and Recovery Practice Question
An organization's security team detects a potential data breach. After confirming the incident, they classify it as P2 (high severity) and begin containment. Which action should be performed FIRST to preserve evidence for forensic analysis?
⚠ Common exam trap
Watch out — candidates often choose 'Disconnect the system from the network' first, thinking containment is the immediate priority, but the SSCP exam emphasizes that evidence preservation (starting with volatile data) must precede containment actions to avoid destroying forensic artifacts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Capture a memory dump using a tool like Magnet RAM Capture
When a high-severity incident (P2) is confirmed, the first priority for forensic preservation is capturing volatile data, which includes system memory (RAM). A memory dump using a tool like Magnet RAM Capture preserves running processes, network connections, encryption keys, and malware in memory that would be lost on shutdown or disconnection. This order follows the volatility principle: capture the most volatile data first before any other action that could alter the system state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disconnect the system from the network
Why it's wrong here
Network isolation is a containment step, but evidence preservation should be prioritized.
- ✓
Capture a memory dump using a tool like Magnet RAM Capture
Why this is correct
Correct. Memory contains volatile evidence that is lost when power is removed.
- ✗
Create a forensic image of the hard drive
Why it's wrong here
Hard drive imaging is important but volatile data should be collected first.
- ✗
Run an antivirus scan to remove malware
Why it's wrong here
Running AV can modify evidence; it should be avoided during initial forensics.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.