Home / ECCouncil / ECSS

Question list

List of questions

Question 1

(0)

Below are the various steps involved in forensic readiness planning. l .Keep an incident response team ready to review the incident and preserve the evidence. 2 .Create a process for documenting t

Question 2

(0)

James is a professional hacker attempting to gain access to an industrial system through a remote control device. In this process, he used a specially designed radio transceiver device to sniff radi

Question 3

(0)

While investigating a web attack on a Windows-based server, Jessy executed the following command on her system: C:\> net view <10.10.10.11> What was Jessy's objective in running the above

Question 4

(0)

Identify the backup mechanism that is performed within the organization using external devices such as hard disks and requires human interaction to perform the backup operations, thus, making it sus

Question 5

(0)

Michael, a forensic expert, was assigned to investigate an incident that involved unauthorized intrusion attempts. In this process, Michael identified all the open ports on a system and disabled the

Question 6

(0)

Alana, an employee in an organization, took a short break after spending exhausting hours on a project. For relaxation, she went to a cafeteria with her laptop, where she connected to the public Int

Question 7

(0)

Bob, a security professional, was recruited by an organization to ensure that application services are being delivered as expected without any delay. To achieve this. Bob decided to maintain differe

Question 8

(0)

Peter, a network defender, was instructed to protect the corporate network from unauthorized access. To achieve this, he employed a security solution for wireless communication that uses dragonfly k

Question 9

(0)

Which of the following environmental controls options saves the hardware from humidity and heat, increases hardware performance, and maintains consistent room temperature?

Question 10

(0)

Martin, a hacker, aimed to crash a target system. For this purpose, he spoofed the source IP address with the target's IP address and sent many ICMP ECHO request packets to an IP broadcast network,

Question 55 - ECSS discussion

Bob, a forensic investigator, is investigating a live Windows system found at a crime scene. In this process, Bob extracted subkeys containing information such as SAM. Security, and software using an automated tool called FTK Imager.

Which of the following Windows Registry hives' subkeys provide the above information to Bob?

H KEY-CLASSES. ROOT

HKEY .CURRENT CONFIG

HKEY CURRENT USER

HKEY LOCAL MACHINE

Suggested answer: D

Explanation:

Certainly! Let's break down the question and identify which Windows Registry hives' subkeys contain the requested information.

Windows Registry Hives:

The Windows Registry is a hierarchical database that holds configuration settings and options for both low-level operating system components and running programs.

It includes settings for the kernel, device drivers, services, user interface, and third-party applications.

The registry allows access to counters for system performance profiling.

Registry Hives:

The registry is organized into different hives, each containing keys and values.

Some important hives include:

HKEY_LOCAL_MACHINE (HKLM): Contains system-wide settings.

HKEY_CURRENT_USER (HKCU): Contains settings specific to the currently logged-in user.

HKEY_USERS (HKU): Contains profiles for all users on the system.

HKEY_CLASSES_ROOT (HKCR): Contains file association information.

HKEY_CURRENT_CONFIG (HKCC): Contains information about the current hardware configuration (only in certain Windows versions).

Subkeys Relevant to Bob's Investigation:

Bob is interested in information related toSAM,Security, andsoftware.

Let's see which hives contain these subkeys:

SAM(Security Account Manager):

The SAM hive stores user account information, including usernames, passwords, account types, enabled status, group memberships, and last logon time.

It is crucial for authentication and security.

Located in:HKEY_LOCAL_MACHINE\SAM

Security:

The Security hive contains security-related information, including access control lists (ACLs), user privileges, and security tokens.

It plays a vital role in enforcing security policies.

Located in:HKEY_LOCAL_MACHINE\Security

Software:

The Software subkey within the HKLM hive contains information related to installed software, configurations, and settings.

It is essential for forensic investigations.

Located in:HKEY_LOCAL_MACHINE\Software

Answer :

The subkeys that provide the requested information to Bob are:

SAM(located inHKEY_LOCAL_MACHINE\SAM)

Security(located inHKEY_LOCAL_MACHINE\Security)

Show Answer

asked 24/10/2024

fritz villanueva

48 questions

Your answer: A B C D

0 comments

Sorted by