Exam 312-49v10 topic 1 question 727 discussion

Actual exam question from ECCouncil's 312-49v10

Question #: 727
Topic #: 1

A digital forensic investigator examines a Windows system to identify suspicious activity related to a recent cyber incident. She has collected volatile and non-volatile registry hives for analysis. The investigator has noticed modifications in a user's profile settings, including changes in desktop wallpaper and screen colors. Which hive and component cells in the registry should she examine more closely for further evidence of user-specific activity?

A. Examine HKEY_CLASSES_ROOT; focus on security descriptor cells and value cells
B. Examine HKEY_LOCAI MACHINE; focus on value cells and subkey list cells
C. Examine HKEY_CURRENT_CONFIG: focus on subkey list cells and value cells
D. Examine HKEY_CURRENT_USER; focus on key cells and value list cells

Show Suggested Answer

Suggested Answer: D 🗳️

by Elb at May 28, 2024, 8:47 p.m.

Comments

Submit Cancel

jingu_bingo

6 months ago

Selected Answer: D

CHFIv11 page 530: "such as desktop wallpaper...settings"

upvoted 2 times

...

Elb

6 months, 1 week ago

Selected Answer: D

HKEY_CURRENT_USER, abbreviated as HKCU, contains the configuration information related to the user currently logged-on. This hive controls the user-level settings associated with user profile such as desktop wallpaper, screen colors, display settings, etc.

upvoted 2 times

...