An incident responder is preparing to acquire images and files from a workstation that has been compromised. The workstation is still powered on and running.
Which of the following should be acquired LAST?
A . Application files on hard disk
B . Processor cache
C . Processes in running memory
D . Swap space
Answer: A
Latest SY0-501 Dumps Valid Version with 1130 Q&As
Latest And Valid Q&A | Instant Download | Once Fail, Full Refund