Exam 312-49v10 topic 1 question 685 discussion

Actual exam question from ECCouncil's 312-49v10

Question #: 685
Topic #: 1

A Computer Hacking Forensic Investigator (CHFI) is examining a compromised Macintosh computer. The system was found to be missing the pre-linked kernel at /System/Library/Caches/com.apple.kernelcaches. What is the next step that the Macintosh boot process will take to load the operating system in such a scenario?

A. The boot loader will attempt to load the mkext cache file containing a set of device drivers
B. The system will initialize the I/O kit and link the loaded drivers to the kernel
C. The boot loader will pass control to BootX (PowerPC) or boot.efi (Intel)
D. The boot loader will search for drivers in the/System/Library/Extensions directory

Show Suggested Answer

Suggested Answer: A 🗳️

by Elb at May 28, 2024, 2:15 a.m.

Comments

Submit Cancel

044f354

5 months, 3 weeks ago

Selected Answer: A

Computer Hacking Forensic Investigator Understanding Hard Disks and File Systems Module 03 Page 236 -------------------------------------- ▪ The boot loader loads a pre-linked version of the kernel located at /System/Library/Caches/com.apple.kernelcaches ▪ If the pre-linked kernel is missing, the boot loader attempts to load the mkext cache file, which contains a set of device drivers ▪ If the mkext cache file is also missing, the boot loader searches for drivers in the /System/Library/Extensions directory -------------------------------------- (EC-Council, 2021-03-01) EC-Council. (2021-03-01). Computer Hacking Forensics Investigator (CHFI) Version 10, 10th Edition. [[VitalSource Bookshelf version]]. Retrieved from vbk://9781635676969

upvoted 1 times

...

aqeel1506

10 months, 3 weeks ago

According to the CHFI v10 textbook, the correct step if the pre-linked kernel is missing is: A. The boot loader will attempt to load the mkext cache file containing a set of device drivers The mkext (Macintosh Kernel Extension) cache file contains a collection of kernel extensions and device drivers. If the pre-linked kernel is missing, the boot loader will attempt to use the mkext cache to load the necessary drivers to boot the system.

upvoted 1 times

...

Elb

11 months, 3 weeks ago

Selected Answer: A

▪ The boot loader loads a pre-linked version of the kernel located at /System/Library/Caches/com.apple.kernelcaches ▪ If the pre-linked kernel is missing, the boot loader attempts to load the mkext cache file, which contains a set of device drivers ▪ If the mkext cache file is also missing, the boot loader searches for drivers in the /System/Library/Extensions directory

upvoted 2 times

...