Study. uk . com
  1. Home
  2. All questions
  3. Question 504

CompTIA Security+ study material · question 504 of 611

A responder is about to power down a compromised server for imaging. What should be captured first?

  1. The system's installed package list
  2. The system's disk partition table
  3. Volatile data such as memory contents and active network connections
  4. The application configuration files
Show the answer

Answer: C. Volatile data such as memory contents and active network connections

Volatile data does not survive a shutdown, while everything on disk remains available afterwards.

Source: NIST SP 800-86 (NIST) — SP 800-86 § 5.2.1 Collecting Volatile OS Data

Challenge yourself on this topic → Study as cards