GIAC

GCED · Question #90

When attempting to collect data from a suspected system compromise, which of the following should generally be collected first?

The correct answer is B. The contents of physical memory. You've hit your limit · resets 1pm (America/New_York)

Data Protection and Incident Response

Question

When attempting to collect data from a suspected system compromise, which of the following should generally be collected first?

Options

AThe network connections and open ports
BThe contents of physical memory
CThe current routing table
DA list of the running services

How the community answered

(57 responses)

A
5% (3)
B
89% (51)
C
4% (2)
D
2% (1)

Explanation

You've hit your limit · resets 1pm (America/New_York)

Topics

#order of volatility#memory forensics#incident response#live acquisition

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion

Full GCED Practice