An incident responder receives a report that a user's workstation is communicating with a known malware C2 IP at regular intervals. Before isolating the workstation, what volatile data should be collected first?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because volatile data (running processes, active network connections, memory contents, logged-in users) is lost when a system is shut down or isolated; this data must be collected before containment actions that disrupt the system's running state. A is wrong because disk images can be collected after isolation; they are non-volatile and do not require urgent collection before containment.
Full explanation below image
Full Explanation
B is correct because volatile data (running processes, active network connections, memory contents, logged-in users) is lost when a system is shut down or isolated; this data must be collected before containment actions that disrupt the system's running state. A is wrong because disk images can be collected after isolation; they are non-volatile and do not require urgent collection before containment. C is wrong because event log files are non-volatile (stored on disk) and can be collected after isolation; they are not the priority volatile data. D is wrong because installed software lists are available from the registry and file system at any time; they are not volatile data.