Microsoft Security IDs are available in Windows Registry Editor. The path to locate IDs in Windows 7 is:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProfileList

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegList

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Regedit

Pagefile.sys is a virtual memory file used to expand the physical memory of a computer. Select the registry path for the page file:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\System Management

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Device Management

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters

In Windows Security Event Log, what does an event id of 530 imply?

Logon Failure - Account logon time restriction violation

Logon Failure - Unknown user name or bad password

Logon Failure - User not allowed to logon at this computer

Logon Failure - Account logon time restriction violation

Logon Failure - Account currently disabled

Which among the following search warrants allows the first responder to get the victim's computer information such as service records, billing records, and subscriber information from the service provider?

Electronic Storage Device Search Warrant

Citizen Informant Search Warrant

Electronic Storage Device Search Warrant

Service Provider Search Warrant

Casey has acquired data from a hard disk in an open source acquisition format that allows her to generate compressed or uncompressed image files. What format did she use?

Advanced Forensics Format (AFF)

When marking evidence that has been collected with the "aaa/ddmmyy/nnnn/zz" format, what does the "nnnn" denote?

The sequential number of the exhibits seized by the analyst

The initials of the forensics analyst

The sequence number for the parts of the same exhibit

The sequential number of the exhibits seized by the analyst

What does the part of the log, "% SEC-6-IPACCESSLOGP", extracted from a Cisco router represent?

A packet matching the log criteria for the given access list has been detected (TCP or UDP)

The system was not able to process the packet because there was not enough room for all of the desired IP header options

Immediate action required messages

Some packet-matching logs were missed because the access list log messages were rate limited, or no access list log buffers were available

A packet matching the log criteria for the given access list has been detected (TCP or UDP)

What is the default IIS log location?

%SystemDrive%\inetpub\logs\LogFiles

Jason discovered a file named $RIYG6VR.doc in the C:\$Recycle.Bin\\ while analyzing a hard disk image for the deleted dat a. What inferences can he make from the file name?

It is a doc file deleted in seventh sequential order

RIYG6VR.doc is the name of the doc file deleted from the system

It is file deleted from R drive

ECCouncil 312-49v10 Practice Test 9 - Free Online Exam Prep & Questions

Which of the following files stores information about local Dropbox installation and account, email IDs linked with the account, current version/build for the local application, the host_id, and local path information?

host.db

sigstore.db

config.db

filecache.db

Comment (0)

ECCouncil 312-49v10 Practice Test 9

Question

ECCouncil 312-49v10 Practice Tests

Practice Tests