A parks IT team schedules memory captures only when ransomware-class alerts fire. What collection strategy is that?

A parks IT team that schedules memory captures only when ransomware-class alerts fire is using trigger-based forensic collection. Full memory images are large, expensive, and disruptive; tying them to high-severity ransomware-class signals preserves volatile evidence when it matters most while avoiding Scheduled forensic collection that runs memory captures only on ransomware-class alerts, which implies a time-based schedule rather than firing immediately when the alert fires. Civic automation should match collection cost to alert confidence and impact so parks infrastructure—often lean on storage and bandwidth—does not drown in unused forensic blobs.

Why the other options fail by concept: Scheduled forensic collection that runs memory captures only on ransomware-class alerts mislabels the strategy because a schedule is time-driven, not alert-triggered, so it risks delaying volatile capture for live keys and beacons that require immediate trigger-based firing when ransomware-class alerts fire. Baseline forensic collection that runs memory captures only on ransomware-class alerts misuses the baseline concept because baselines are routine reference snapshots for comparison, not alert-triggered captures, so it misses the immediate event-driven preservation of live decryption keys, injected payloads, and in-memory beacons. Continuous forensic collection that runs memory captures only on ransomware-class alerts fails because continuous means always-on capture, not firing only when ransomware-class alerts fire, and continuously capturing full memory images would burn bandwidth and storage unlike trigger-based collection that fires only on high-severity alerts.

Exam caveat: Trigger-based capture assumes ransomware-class alert quality is good enough; noisy or missing detections will under-collect, so detection tuning and capture policy must mature together. Operational check: inject a ransomware-class test alert on a parks lab endpoint, confirm memory capture starts automatically, measure artifact size and destination, and verify non-ransomware informational alerts do not enqueue memory jobs.