200-201 Question 364
Select 3During an active incident response investigation, a cybersecurity analyst needs to collect volatile data from a compromised system. Which of the following actions should the analyst prioritize to ensure volatile data is captured in the correct order of volatility?
- A
Capture the contents of RAM using a memory acquisition tool.
- B
Record the running processes and active network connections.
- C
Copy the contents of the hard drive to an external storage device.
- D
Collect system time and logged-on user information.
- E
Dump the system's pagefile for analysis.
Show answer and explanation
Correct answers: A, B, D
Explanation
The correct answers focus on capturing data that is highly volatile and can be lost quickly, such as information stored in RAM, active processes, network connections, and system time. These should be prioritized during volatile data collection, while non-volatile data like hard drive contents or pagefile data can be collected later in the forensic process.
- A. Correct.
Capturing the contents of RAM is a critical step in collecting volatile data, as it contains temporary information such as running processes and active network sessions. RAM data is highly volatile and should be captured early in the process.
- B. Correct.
Recording running processes and active network connections is essential because this information is stored in memory and can change or disappear quickly during an investigation.
- C. Incorrect.
Copying the contents of the hard drive is not considered volatile data collection, as hard drive data is non-volatile and persists even after a system reboot or power loss.
- D. Correct.
Collecting system time and logged-on user information is a key step in volatile data collection, as this information resides in memory and can change quickly.
- E. Incorrect.
Dumping the system's pagefile is useful for forensic analysis, but it is not considered highly volatile data compared to information like RAM or active processes, which should be prioritized.