Exam CS0-003 topic 1 question 391 discussion

Actual exam question from CompTIA's CS0-003

Question #: 391
Topic #: 1

Which of the following defines the proper sequence of data volatility regarding the evidence collection process, from the most to least volatile?

A. Routing table, registers, physical memory, archival media, hard disk, physical configuration
B. Routing table, registers, physical memory, temporary partition, hard disk, physical configuration
C. Cache, routing table, physical memory, network topology, temporary partition, hard disk
D. Cache, routing table, physical memory, temporary partition, hard disk, physical configuration

Show Suggested Answer

Suggested Answer: D 🗳️

by Justheretolook at May 22, 2025, 8:36 p.m.

Comments

Submit Cancel

Justheretolook

1 month ago

Selected Answer: D

The correct answer is: D. Cache, routing table, physical memory, temporary partition, hard disk, physical configuration Explanation: In digital forensics, data volatility refers to how quickly data is lost when power is removed or systems are shut down. The order of volatility (OOV) from most to least volatile is: 1. Cache – Stored in CPU, lost instantly when power is off. 2. Routing table – Dynamic data in memory, changes frequently. 3. Physical memory (RAM) – Volatile and gone after shutdown. 4. Temporary partition – Includes swap/page files, less volatile than RAM. 5. Hard disk – Non-volatile, data persists even without power. 6. Physical configuration – Includes device setup and network layout; rarely changes.

upvoted 2 times

...