An incident responder receives a report that a user's workstation is communicating with a known malware C2 IP at regular intervals. Before isolating the workstation, what volatile data should be collected first?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — b is correct because volatile data (running processes, active network connections, memory contents, logged-in users) is lost when a system is shut down or isolated; this data must be collected before containment actions that disrupt the system's running state. A is wrong because disk images can be collected after isolation; they are non-volatile and do not require urgent collection before containment.
Full Explanation
B is correct because volatile data (running processes, active network connections, memory contents, logged-in users) is lost when a system is shut down or isolated; this data must be collected before containment actions that disrupt the system's running state. A is wrong because disk images can be collected after isolation; they are non-volatile and do not require urgent collection before containment. C is wrong because event log files are non-volatile (stored on disk) and can be collected after isolation; they are not the priority volatile data. D is wrong because installed software lists are available from the registry and file system at any time; they are not volatile data.