CompTIACompTIA
SY0-701 · Question #381
SY0-701 Question #381: Real Exam Question with Answer & Explanation
The correct answer is B: RAM. When the computer powers off, anything in the RAM is going to be lost. Therefore, collecting potential evidence out of the RAM is the first thing that should be done out of these options.
Submitted by kev92· Mar 6, 2026Security Operations
Question
While performing digital forensics, which of the following is considered the most volatile and should have the contents collected first?
Options
- AHard drive
- BRAM
- CSSD
- DTemporary files
Explanation
When the computer powers off, anything in the RAM is going to be lost. Therefore, collecting potential evidence out of the RAM is the first thing that should be done out of these options.
Community Discussion
No community discussion yet for this question.