MENU
When attempting to collect data from a suspected system compromise, which of the following should generally be collected first?
Suggested Answer: A
Get Premium GCED Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
37 comments · newest first
CA
Caprice
10 months ago
I always thought routing tables were the least important in these cases.
LA
Layla
11 months ago
Wait, are we really prioritizing memory over network data? Seems off.
AM
Amina
11 months ago
Running services can give you quick insights too.
AN
Anabel
11 months ago
I think the network connections are more critical to check first.
CA
Cassie
11 months ago
Definitely the contents of physical memory first!
AS
Ashley
11 months ago
I might be mixing things up, but wasn't there something about the current routing table being crucial in some scenarios? It feels like it could be important.
HA
Harrison
12 months ago
I feel like the running services could give us a lot of insight into what's happening. But I can't remember if that's the first thing we should look at.
MA
Mammie
12 months ago
I'm not so sure about that. I remember a practice question where we focused on network connections first. Maybe that's important too?
CE
Celestine
12 months ago
I think we should collect the contents of physical memory first, right? It seems like the most volatile data.
LE
Leonida
12 months ago
Hmm, I'm not totally confident on this. I was thinking maybe the current routing table (C) would be a good place to start, but now I'm second-guessing that. I'll have to review my notes on incident response procedures to make sure I get this right.
AN
Anglea
12 months ago
Easy peasy! The answer is clearly B - the contents of physical memory. That's the first and most important thing to capture in a suspected system compromise. Can't go wrong with that one.
CA
Caitlin
1 year ago
I'm a bit unsure on this one. I'm torn between A and B. Collecting the network connections and open ports could be really helpful, but the contents of physical memory might be even more important to preserve. I'll have to think this through carefully.
BR
Brynn
1 year ago
Hmm, this seems like a tricky one. I think I'll go with B - the contents of physical memory. That seems like the most critical data to collect first before anything else gets changed or tampered with.
MA
Malika
1 year ago
I'm a bit confused by the part about exceptions being resolved on the same page. I'll need to think through how that might affect the number of times the 'Email Customer' sub-page is executed.
HA
Hayley
1 year ago
I remember learning about this in class, but I'm drawing a blank on the specifics. I'll have to read the options closely.
MA
Marylin
1 year ago
I think vehicle registration is a fixed cost because it's something you pay regardless of how many trips you make.
RO
Rodolfo
1 year ago
I'm going to have to go with B) The contents of physical memory. It's like trying to solve a mystery without the crime scene photos!
FR
Frederica
1 year ago
C) The current routing table, for sure. You need to know where the traffic is going to track down the attacker's movements.
RO
Rose
1 year ago
C) The current routing table
PA
Paris
1 year ago
B) The contents of physical memory
EL
Ellen
1 year ago
A) The network connections and open ports
BE
Beula
1 year ago
Hmm, I'm torn between B) and D). I think physical memory is key, but a list of running services could also provide vital clues.
TI
Tien
1 year ago
Let's prioritize collecting both B) and D) to cover all bases in our investigation.
LA
Laine
1 year ago
D) A list of the running services can also give us important information about the compromise.
IZ
Izetta
1 year ago
I think B) The contents of physical memory is crucial for detecting a system compromise.
MA
Malinda
1 year ago
I'm going with A) The network connections and open ports. That's crucial to understanding the initial attack vector.
GE
Gerald
1 year ago
C) Once we have the network connections and open ports, we can then move on to collecting other data to piece together the puzzle.
NI
Nidia
1 year ago
B) I agree, understanding the initial attack vector is key. It sets the foundation for further investigation.
AL
Alease
1 year ago
A) The network connections and open ports is definitely the first thing to collect. It can provide valuable information about the attack.
YO
Yoko
2 years ago
Definitely B) The contents of physical memory. That's the first thing I learned in my incident response training.
SH
Shaniqua
1 year ago
D) A list of the running services
CH
Charlesetta
1 year ago
C) The current routing table
RO
Roosevelt
1 year ago
B) The contents of physical memory
AN
Antonette
1 year ago
A) The network connections and open ports
TR
Truman
2 years ago
I agree with Owen, capturing the contents of physical memory can provide valuable insights into the compromise.
OW
Owen
2 years ago
I disagree, I believe B) The contents of physical memory is more crucial in a suspected system compromise.
LA
Laurel
2 years ago
I think A) The network connections and open ports should be collected first.