nerdexam
CompTIA

CAS-002 · Question #837

During an incident involving the company main database, a team of forensics experts is hired to respond to the breach. The team is in charge of collecting forensics evidence from the company's…

The correct answer is D. Secure the scene, take inventory, capture volatile storage, capture non-volatile storage. Digital forensic investigations must follow a defined order - securing the scene first, then inventorying assets, then collecting evidence from most volatile to least volatile storage.

Enterprise Security

Question

During an incident involving the company main database, a team of forensics experts is hired to respond to the breach. The team is in charge of collecting forensics evidence from the company's database server. Which of the following is the correct order in which the forensics team should engage?

Options

  • ANotify senior management, secure the scene, capture volatile storage, capture non-volatile
  • BTake inventory, secure the scene, capture RAM, capture had drive, implement chain of custody,
  • CImplement chain of custody, take inventory, secure the scene, capture volatile and non-volatile
  • DSecure the scene, take inventory, capture volatile storage, capture non-volatile storage,

How the community answered

(35 responses)
  • B
    3% (1)
  • C
    6% (2)
  • D
    91% (32)

Why each option

Digital forensic investigations must follow a defined order - securing the scene first, then inventorying assets, then collecting evidence from most volatile to least volatile storage.

ANotify senior management, secure the scene, capture volatile storage, capture non-volatile

Notifying senior management before securing the scene and capturing volatile evidence risks evidence tampering and the irreversible loss of RAM contents before collection begins.

BTake inventory, secure the scene, capture RAM, capture had drive, implement chain of custody,

Taking inventory before securing the scene allows unauthorized individuals to access or alter the environment, potentially contaminating evidence prior to any collection.

CImplement chain of custody, take inventory, secure the scene, capture volatile and non-volatile

Implementing chain of custody before the scene is secured and evidence is collected is procedurally invalid - chain of custody is applied to evidence after it has been collected and documented, not before.

DSecure the scene, take inventory, capture volatile storage, capture non-volatile storage,Correct

Securing the scene first prevents evidence contamination or tampering, taking inventory documents all assets before anything is touched, and then volatile storage (RAM, running processes, network state) must be captured before non-volatile storage (hard drives) because volatile data is permanently lost upon power-off. This sequence preserves the integrity and admissibility of forensic evidence.

Concept tested: Digital forensics order of operations and evidence volatility

Source: https://csrc.nist.gov/publications/detail/sp/800-86/final

Topics

#digital forensics#order of volatility#chain of custody#incident response

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice