CS Professional · Artificial Intelligence, Data Analytics and Cyber Security - Laws and Practice · Cyber Security
A forensic investigator must collect evidence from a running server suspected of a breach. Following the order of volatility, which item should be captured first?
RAM contents and running processes should be captured first. Under the order of volatility, the most short-lived data is collected before more persistent sources such as disks and backups, because memory is lost when the system is powered down or restarted.
- AArchived backup tapes stored offsite
- BContents of the hard disk
- CRAM contents and running processesCorrect
- DPrinted network diagrams
Explanation
The order of volatility says to collect the most short-lived data first. RAM and running processes vanish at power-off, whereas disk data persists longer and backups and printed documents are the least volatile. Starting with the disk risks losing memory-resident evidence such as active connections or keys.
Did you get it right without looking?
One question tells you little. A timed set on Cyber Security shows your real accuracy, how long you take and where you lose marks.
More Cyber Security questions
- Meera, a company secretary, wants to produce an email printout as evidence in an Indian court. Under the Indian law on electronic records as…
- Ravi receives an email that appears to come from his bank, asking him to click a link and enter his net-banking password to avoid account su…
- In the CIA triad used to describe the objectives of cyber security, what does the 'Integrity' element primarily protect against?
- Under the IT Act, 2000, which of the following is the legal function of a digital signature certificate issued by a Certifying Authority?
- An attacker silently positions himself between a customer's device and a bank's server on an unsecured public Wi-Fi network, reading and pos…
- Under the Information Technology Act, 2000, which authority serves as the national agency for performing functions in the area of cyber secu…