Which of the following is the LEAST volatile when performing incident response procedures?

The correct answer is D. Hard drive. In incident response, the 'order of volatility' guides which data to collect first before it disappears. From most to least volatile: CPU registers → RAM → swap/temp files → hard drive → optical media/backups. Registers (A) lose data the instant power is cut. RAID cache (B) and…

Security operations

Question

Options

ARegisters
BRAID cache
CRAM
DHard drive

How the community answered

(34 responses)

A
3% (1)
B
3% (1)
D
94% (32)

Explanation

In incident response, the 'order of volatility' guides which data to collect first before it disappears. From most to least volatile: CPU registers → RAM → swap/temp files → hard drive → optical media/backups. Registers (A) lose data the instant power is cut. RAID cache (B) and RAM (C) are also highly volatile, losing data on power loss. A hard drive (D) retains data without power, making it the LEAST volatile of the options. Investigators always collect the most volatile evidence first.

Topics

#order of volatility#incident response#digital forensics#volatile data

Community Discussion

No community discussion yet for this question.

Full SY0-301 Practice