PrepSnap logoPrepSnap
Pass

Question

1.
2.
3.
4.
Answer (Detailed Solution Below)

Option 2 : Capture volatile memory, including RAM contents and encryption keys, before any shutdown

Advertisement

Detailed Solution

सही उत्तर Capture volatile memory, including RAM contents and encryption keys, before any shutdown है।

Key Points
Helpful?
PrepSnapprepsnap.in • Part -A

Question:

A suspect's server is running with encrypted volumes mounted and active network connections. According to the order of volatility, which step must come FIRST? / संदिग्ध का सर्वर एन्क्रिप्टेड वॉल्यूम माउंट किए और सक्रिय नेटवर्क कनेक्शन के साथ चल रहा है। वोलैटिलिटी के क्रम के अनुसार सबसे पहले कौन-सा कदम उठाना चाहिए?

1.
Pull the power plug immediately to freeze the system state
2.
Capture volatile memory, including RAM contents and encryption keys, before any shutdown
3.
Image the hard disks first while the system keeps running
4.
Photograph the monitor and consider the acquisition complete

Correct Answer: Capture volatile memory, including RAM contents and encryption keys, before any shutdown

RAM, cache and keys are the most volatile artifacts and vanish on power loss; the order of volatility demands capturing them before touching disks or power. / RAM और कीज़ सबसे अधिक वोलैटाइल हैं; पावर बंद होते ही नष्ट हो जाती हैं, इसलिए इन्हें सबसे पहले कैप्चर करना होता है। Option (a) is the trap — pulling the plug destroys exactly the evidence most at risk.

Downloaded from PrepSnap (prepsnap.in)