SSCP Incident Response and Recovery Practice Question
During a forensic investigation, an examiner needs to preserve volatile evidence. Which of the following lists the correct order of collection for volatile data?
⚠ Common exam trap
The SSCP exam often tests the 'order of volatility' principle, and the trap here is that candidates mistakenly prioritize network connections or running processes over RAM, not realizing that RAM is the most volatile and must be captured first to preserve evidence like encryption keys or active malware payloads.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
RAM, network connections, running processes, hard drive image
Volatile data must be collected in order of decreasing volatility to prevent loss of critical evidence. RAM is the most volatile (lost on power-off), followed by network connections (state changes rapidly), then running processes (persist slightly longer), and finally the hard drive image (non-volatile). This order follows the RFC 3227 guidelines for evidence collection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hard drive image, network connections, running processes, RAM
Why it's wrong here
RAM should be first, not last.
- ✗
Running processes, RAM, hard drive image, network connections
Why it's wrong here
RAM should be first.
- ✓
RAM, network connections, running processes, hard drive image
Why this is correct
Correct. RAM is most volatile, then network state, then processes, then disk.
- ✗
Network connections, hard drive image, RAM, running processes
Why it's wrong here
RAM is more volatile than network or disk.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.