nerdexam
CompTIA

CS0-003 · Question #540

Which of the following defines the proper sequence of data volatility regarding the evidence collection process, from the most to least volatile?

The correct answer is D. Cache, routing table, physical memory, temporary partition, hard disk, physical configuration. Data volatility refers to how quickly data can be lost or overwritten, and the correct evidence collection sequence prioritizes acquiring the most volatile data first.

Submitted by minji_kr· Mar 6, 2026Incident Response and Management

Question

Which of the following defines the proper sequence of data volatility regarding the evidence collection process, from the most to least volatile?

Options

  • ARouting table, registers, physical memory, archival media, hard disk, physical configuration
  • BRouting table, registers, physical memory, temporary partition, hard disk, physical configuration
  • CCache, routing table, physical memory, network topology, temporary partition, hard disk
  • DCache, routing table, physical memory, temporary partition, hard disk, physical configuration

How the community answered

(27 responses)
  • A
    4% (1)
  • C
    4% (1)
  • D
    93% (25)

Why each option

Data volatility refers to how quickly data can be lost or overwritten, and the correct evidence collection sequence prioritizes acquiring the most volatile data first.

ARouting table, registers, physical memory, archival media, hard disk, physical configuration

Registers are more volatile than routing tables and physical memory is more volatile than archival media.

BRouting table, registers, physical memory, temporary partition, hard disk, physical configuration

Registers are more volatile than routing tables, and temporary partitions are more volatile than hard disks.

CCache, routing table, physical memory, network topology, temporary partition, hard disk

Cache is correctly placed, but network topology is a static configuration and less volatile than temporary partitions and hard disks, which is an incorrect ordering.

DCache, routing table, physical memory, temporary partition, hard disk, physical configurationCorrect

The correct sequence from most to least volatile is Cache (CPU registers/cache), Routing table (network state), Physical memory (RAM), Temporary partition (swap/temp files), Hard disk (persistent storage), and Physical configuration (static system settings). This order ensures that data that is most likely to change or be lost is collected first during a forensic investigation.

Concept tested: Data Volatility Order in Forensics

Source: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/appendix-l-physical-evidence-collection-order

Topics

#Data volatility#Evidence collection#Forensics#Digital forensics

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CS0-003 Practice