When the computer powers off, anything in the RAM is going to be lost. Therefore, collecting potential evidence out of the RAM is the first thing that should be done out of these options.
B is correct.
You start collecting forensic contents based on the order of volatility which is from the most volatile to the least. You collect CPU, Cache and Registers first and RAM 2nd which contains active processes, open network connections, user sessions and temp data which are lost when the system is powered off. Temporary files and hard drive/SSD comes last in the order receptively.
upvoted 8 times
...
This section is not available anymore. Please use the main Exam Page.SY0-701 Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
TrebleSmith
Highly Voted 8 months, 4 weeks agoa4e15bd
Highly Voted 9 months, 1 week ago