Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
CompTIA CySA+ Cybersecurity Analyst · CompTIA
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Running processes (D): This includes currently executing programs and services and is highly volatile as it can change rapidly. Temporary files (C): Temporary files may contain information relevant to the incident and are relatively more volatile than disk contents and backup data. Disk contents (A): Disk contents are less volatile than running processes and temporary files, as they represent the stored data on the disk. Backup data (B): Backup data is typically the least volatile as it represents a snapshot of the system at a previous point in time.
The correct answer is D. Running processes
The most volatile type of evidence that must be collected first in a computer system is running processes. Running processes are programs or applications that are currently executing on a computer system and using its resources, such as memory, CPU, disk space, or network bandwidth. Running processes are very volatile because they can change rapidly or disappear completely when the system is shut down, rebooted, logged off, or crashed.