Exam CAS-003 topic 1 question 411 discussion

We are collecting evidence to confirm whether there was a breach and RAM is most volatile (hence, the first thing that needs to be collected).

You can find similar "order of volatility" questions in Sec+ and CySA+ too. As the analyst has determined not to remediate the damage as the first step, he would be going for the current memory contents.

B. keyword: outside agent

Agree C The order of volatility is the sequence or order in which the digital evidence is collected. The order is maintained from highly volatile to less volatile data. Highly volatile data resides in the memory, cache, or CPU registers, and it will be lost as soon as the power to the computer is turned off.

Maybe: C. Dump the contents of the RAM? The PC is not in the process of being breached. It is suspected of having been breached in the past. As such, checking ingoing and outgoing traffic won't tell you anything. You want to shut the system down ASAP because the system may be infecting other systems. But before you shut the system down, it is probably best to save RAM.

This is a tricky one. A. Create an image of the hard drive -> Not what we normally do first. B. Capture the incoming and outgoing network traffic -> If the system is on this is first. C. Dump the contents of the RAM -> If the system is on this is second. Unfortunately a very poor question, but I think I'd answer B on the exam.