CS Professional · Artificial Intelligence, Data Analytics and Cyber Security - Laws and Practice · Cyber Security

A forensic examiner must collect evidence from a running server that is suspected to be compromised. Considering the order of volatility, which item should be captured first?

RAM and running process data should be captured first because it is the most volatile and is lost when the system is shut down or changes. Disk files, backups and printed logs are more persistent and can be collected afterwards.

AContents of RAM and running processesCorrect
BArchived backup tapes stored offsite
CFiles stored on the hard disk
DPrinted logs kept in a cabinet

Explanation

The order of volatility says to collect the most short-lived data first. RAM, running processes and network connections vanish on power-off or change continually, whereas disk contents, backups and paper records persist longer. Capturing disk first could lose the memory data, which is why the disk option is wrong.

Did you get it right without looking?

One question tells you little. A timed set on Cyber Security shows your real accuracy, how long you take and where you lose marks.

Practise Cyber Security Free diagnostic mock

More Cyber Security questions