mediumMultiple ChoiceObjective-mapped
SSCP Practice Question: During incident response, a team member uses a…
During incident response, a team member uses a tool to capture memory from a compromised Windows system. Which of the following best describes the order of volatility?
⚠ Common exam trap
Many candidates confuse volatility with importance, assuming disk (which contains persistent data) is more critical to capture first, when in fact the most volatile data (network connections) must be prioritized to prevent loss.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network connections, memory, disk
The order of volatility dictates that the most volatile data (network connections) should be captured first, followed by memory, and finally disk. Network connections change constantly and are lost when the system is powered off, while memory (RAM) persists until power loss, and disk is the least volatile as it retains data even after shutdown. This sequence ensures critical evidence is preserved before it disappears.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Network connections, memory, disk
Why this is correct
Network connections change rapidly, memory is less volatile, disk is most persistent.
- ✗
Disk, memory, network
Why it's wrong here
Disk is least volatile, so should be last.
- ✗
Memory, network, disk
Why it's wrong here
Network is more volatile than memory.
- ✗
Memory, disk, network connections
Why it's wrong here
Network connections are more volatile than memory.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.