CompTIA Security+ (SY0-501) — Question 747

When performing data acquisition on a workstation, which of the following should be captured based on memory volatility? (Choose two.)

Answer options

• A. USB-attached hard disk
• B. Swap/pagefile
• C. Mounted network storage
• D. ROM
• E. RAM

Correct answer: B, E

Explanation

The correct answers are B and E because both the swap/pagefile and RAM are volatile memory types, meaning they lose their data when power is lost. Options A, C, and D are incorrect as USB-attached hard disks, mounted network storage, and ROM are non-volatile and do not rely on continuous power to retain data.