200-201 Question 358
Single answerYou are a cybersecurity analyst responding to a suspected data breach in your organization's network. During the investigation, you need to collect evidence in a manner that ensures it can be used in legal proceedings. Which of the following represents the correct evidence collection order to maximize the integrity of the evidence?
- A
Collect data from volatile memory (RAM) first, followed by logs and hard drive contents.
- B
Start with physical evidence such as hard drives, then collect data from volatile memory (RAM) and logs.
- C
Capture network traffic first, then gather data from RAM, followed by logs and hard drives.
- D
Prioritize collecting logs from the server before attempting to access volatile memory (RAM) or network traffic.
Show answer and explanation
Correct answer: A
Explanation
The evidence collection order is crucial in incident response to ensure the integrity and admissibility of evidence. Volatile data, such as RAM and live network traffic, is the most susceptible to loss and should be collected first. Less volatile data, like logs and hard drive contents, can be collected later as they are more persistent. Following this order helps maintain the chain of custody and ensures no critical evidence is lost.
- A. Correct.
Collecting data from volatile memory (RAM) first is correct because it is the most volatile form of evidence and can be lost quickly if the system is powered off or altered. Logs and hard drive contents are less volatile and can be collected after volatile evidence is secured.
- B. Incorrect.
Starting with physical evidence, such as hard drives, is incorrect because hard drives are less volatile compared to data in RAM or network traffic, which should be prioritized.
- C. Incorrect.
Capturing network traffic first is incorrect because while network traffic is important, data in RAM is typically more volatile and should be collected before network traffic to preserve evidence integrity.
- D. Incorrect.
Prioritizing logs from the server over volatile memory or network traffic is incorrect because logs are less volatile than RAM and network traffic, which should be collected first.