Câu 122: CS0-003: CompTIA CySA+ (CS0-003)

During an incident, an analyst needs to acquire evidence for later investigation. Which of the following must be collected first in a computer system, related to its volatility level?

1. A. Disk contents
2. B. Backup data
3. C. Temporary files
4. D. Running processes — đáp án hiện tại