Drag and Drop Questions A forensic analyst is asked to respond to an ongoing network attack on a server. Place the items in the list below in the correct order in which the forensic analyst should…

The correct answer is CPU cache; RAM; Swap; Hard drive. In digital forensics, evidence must be collected in order of volatility - from most volatile (data lost quickest) to least volatile (data persists longest). CPU cache is the most volatile as it is lost the instant power is interrupted or processes change, followed by RAM which…

Submitted by rania.sa· Mar 4, 2026CompTIA Security+ / CySA+ - Incident Response: Utilize appropriate forensic procedures including the order of volatility when preserving digital evidence during an investigation.

Question

Drag and Drop Questions A forensic analyst is asked to respond to an ongoing network attack on a server. Place the items in the list below in the correct order in which the forensic analyst should preserve them. Answer:

Exhibits

Answer Area

Drag items

RAMCPU cacheSwapHard drive

Correct arrangement

CPU cache
RAM
Swap
Hard drive

Explanation

In digital forensics, evidence must be collected in order of volatility - from most volatile (data lost quickest) to least volatile (data persists longest). CPU cache is the most volatile as it is lost the instant power is interrupted or processes change, followed by RAM which loses data on power loss, then swap space (virtual memory on disk) which is more persistent than RAM but still temporary, and finally the hard drive which retains data without power indefinitely. This 'Order of Volatility' principle, outlined in RFC 3227, ensures the most transient and easily lost evidence is captured first.

Topics

#Digital Forensics#Order of Volatility#Incident Response#Evidence Preservation

Community Discussion

No community discussion yet for this question.

Full SY0-501 Practice