GIAC GCED Exam - Topic 9 Question 81 Discussion

Actual exam question for GIAC's GCED exam

Question #: 81
Topic #: 9

[All GCED Questions]

Of the following pieces of digital evidence, which would be collected FIRST from a live system involved in an incident?

AEvent logs from a central repository

BDirectory listing of system files

CMedia in the CDrom drive

DSwap space and page files

Show Suggested Answer

Suggested Answer: D

Best practices suggest that live response should follow the order of volatility, which means that you want to collect data which is changing the most rapidly. The order of volatility is:

Memory

Swap or page file

Network status and current / recent network connections

Running processes

Open files

by Shonda at Jun 29, 2026, 10:43 PM

Limited Time Offer

25%

Off

Get Premium GCED Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Alex

2 days ago

I practiced a similar question, and I feel like the directory listing might be important, but I can't recall if it's the first thing to collect.

upvoted 0 times

...

Loren

7 days ago

I'm not entirely sure, but I remember something about event logs being crucial for understanding what happened during an incident.

upvoted 0 times

...

Galen

12 days ago

I think we should prioritize collecting the swap space and page files first since they might contain volatile data.

upvoted 0 times

...