Windows Memory and Artifact Analysis DFE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is an example of correlating memory and disk artifacts?

   • AReviewing the network router logs.
   • BMatching a process found in memory to an executable file on disk.
   • CExamining the physical condition of the hard drive.
   • DChecking the system time in the BIOS.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which registry key is commonly used to determine programs that run at system startup?

   • AHKEY_CURRENT_USER\Control Panel\Desktop
   • BHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
   • CHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   • DHKEY_CLASSES_ROOT\exefile\shell\open\command
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An investigator is analyzing a Windows system to reconstruct a user's activities. The investigator has access to the user's NTUSER.DAT hive and the Recent folder. Which combination of artifacts would provide the most comprehensive evidence of the user's actions?

   • ARecent folder LNK files and the $MFT
   • BBrowser history and the Security event log
   • CNTUSER.DAT and the Prefetch folder
   • DNTUSER.DAT, Recent folder LNK files, and the user's browser history
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which Windows event log is most likely to contain records of successful and failed logon attempts?

   • ASetup
   • BApplication
   • CSecurity
   • DSystem
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which registry hive contains information about the currently logged-in user's settings and activity?

   • AHKEY_LOCAL_MACHINE\SOFTWARE
   • BHKEY_LOCAL_MACHINE\SYSTEM
   • CHKEY_CLASSES_ROOT
   • DHKEY_CURRENT_USER (HKU\.DEFAULT)
   Reveal Solution Discussion Select an answer first