CompTIA CySA+ (CS0-002) — Question 111

A digital forensics investigator works from duplicate images to preserve the integrity of the original evidence. Which of the following types of media are MOST volatile and should be preserved? (Choose two.)

Answer options

• A. Memory cache
• B. Registry file
• C. SSD storage
• D. Temporary filesystems
• E. Packet decoding
• F. Swap volume

Correct answer: A, F

Explanation

The correct answers, A and F, represent types of volatile data that can be lost when the system is powered down or restarted. Memory cache is temporary storage that holds data for quick access, while swap volume serves as temporary storage for data that does not fit in RAM. The other options, while important, do not have the same level of volatility and can be preserved through other means.