CompTIA
SY0-701 · Question #381
While performing digital forensics, which of the following is considered the most volatile and should have the contents collected first?
The correct answer is B. RAM. When the computer powers off, anything in the RAM is going to be lost. Therefore, collecting potential evidence out of the RAM is the first thing that should be done out of these options.
Submitted by kev92· Mar 6, 2026Security Operations
Question
While performing digital forensics, which of the following is considered the most volatile and should have the contents collected first?
Options
- AHard drive
- BRAM
- CSSD
- DTemporary files
How the community answered
(21 responses)- A5% (1)
- B90% (19)
- C5% (1)
Explanation
When the computer powers off, anything in the RAM is going to be lost. Therefore, collecting potential evidence out of the RAM is the first thing that should be done out of these options.
Community Discussion
No community discussion yet for this question.