Which of the following should be acquired LAST?

exams SY0-501 SY0-501 exam 0 Comments

An incident responder is preparing to acquire images and files from a workstation that has been compromised. The workstation is still powered on and running.

Which of the following should be acquired LAST?
A . Application files on hard disk
B . Processor cache
C . Processes in running memory
D . Swap space

Answer: A