According to the order of volatility, which sequence correctly lists components from most volatile to least volatile?

• A. Registers & Cache, RAM, Disk, Network Logs, Archive
• B. Remote logs, RAM, Disk, Cache, Topology
• C. CPU cache, Disk, Network Logs, Archive
• D. Registers & Cache, RAM, Disk, Remote Logging and Monitoring Data, Physical Configuration

Answer: (D)

The main concept being tested is the order of volatility: which data tends to disappear first when a system loses power or is otherwise compromised. You should collect data in the sequence from most volatile to least volatile.

The correct sequence from most volatile to least volatile is: data in CPU registers and CPU cache, then RAM, then disk storage, then remote logging and monitoring data, and finally physical configuration. Data in the CPU’s registers and cache is overwritten or cleared as soon as operations stop and power is removed, so it vanishes almost immediately. RAM holds the current state and running data, but it is still volatile and will be lost when power is cut, though it lasts a bit longer than registers and cache. Disk storage persists across reboots and shutdowns, making it less volatile than RAM. Remote logging and monitoring data exists on external systems; while you may still recover it, its availability depends on the remote source, network, and retention policies, so it’s less volatile than local storage but more volatile than hardware configuration. Physical configuration (hardware, firmware, and system architecture) changes rarely and is the least volatile among these items.

Other sequences misplace these relationships, such as treating cache as less volatile than registers, or placing remote logging before disk, which contradicts how quickly each type can be lost or preserved.