CompTIA CySA+ (CS0-003) — Question 315

Which of the following defines the proper sequence of data volatility regarding the evidence collection process, from the most to least volatile?

Answer options

• A. Routing table, registers, physical memory, archival media, hard disk, physical configuration
• B. Routing table, registers, physical memory, temporary partition, hard disk, physical configuration
• C. Cache, routing table, physical memory, network topology, temporary partition, hard disk
• D. Cache, routing table, physical memory, temporary partition, hard disk, physical configuration

Correct answer: D

Explanation

The correct answer is D as it accurately reflects the hierarchy of data volatility, starting with the most volatile (Cache) and moving to the least volatile (physical configuration). Answers A, B, and C all contain elements that do not align with the correct order of volatility, particularly in the placement of physical memory and hard disk.