When attempting to collect data from a suspected system compromise, which of the following should generally be collected first?

When attempting to collect data from a suspected system compromise, which of the following should generally be collected first?
A . The network connections and open ports
B . The contents of physical memory
C . The current routing table
D . A list of the running services

Answer: B