A hotel reservations server is still running, its memory matters to the case, and the plan lists unplugging the server, copying memory, and hashing a disk image. Which action should happen first?
Select an answer to reveal the explanation.
Short Explanation
Photograph the whiteboard before someone hits the lights. You copy memory while the hotel server is still running. The trap is unplugging first, hashing an image you have not taken, or posting the memory to a channel.
Full Explanation
The right selection is "Copy the server memory now, while the reservations host is still running and power is applied". NIST SP 800-86 collects volatile state before power is removed, because memory, processes, and live connections disappear at power-off. The stem says the server is running and memory matters, so the copy comes before the plug. The statement "Unplug the reservations server before any other action so guest traffic stops immediately" destroys the volatile state the case still needs. The statement "Hash a disk image that has not been created yet and treat that missing image as already sealed" cannot be done yet, because there is no image to hash until a disk image has been taken. The statement "Publish the raw server memory to the hotel operations channel before a copy is stored" exposes the contents and is not a collection step at all. Exam caveat: when a plan already says severity requires immediate isolation, power removal can come first; this case still needs the memory, so isolation waits. Operational check: confirm a memory image has been written and its hash recorded while the server still shows a running process list, and only then consider removing power.