CS0-003 Question 20

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D2

  Volatile data must always be collected first, and routing tables are highly volatile because they change dynamically as the system processes network traffic. Capturing the routing table before isolating the server preserves critical evidence about active network paths and potential attacker communication channels that would disappear once the system is taken offline.

• Chose D2

  D) Routing table. When responding to an incident, volatile data—information that disappears when the system is powered down or rebooted—should be collected first. The routing table is part of this volatile data and can reveal: Active network paths Potential attacker communication routes Evidence of lateral movement or exfiltration Once the system is isolated or shut down, this data is lost. That’s why it’s prioritized.

• Chose D1

  Routing Table is volatile data.