Questions
- Where would you find the registry files?
a.
%SystemRoot%\System32\Config
b.
%SystemRoot%\System32
c.
%SystemRoot%\\Config\System32
d.
%SystemRoot%\System64\Config
- When examining log files, which event ID identifies a successful logon?
a. 4624
b. 4625
c. 4672
d. 4642
- A thumbcache is a ______________.
a. Database of toenail images
b. Database of thumbnail images
c. Database of deleted thumbnail images
d. Database of deleted images
- The user can use Internet Explorer/Edge to view files.
a. True
b. False
- Which of the following will you find in a link (LNK) file?
a. Volume serial number
b. Router name
c. Date of deletion
d. Volume details
- Which of the following Microsoft Windows operating systems uses JumpLists?
a. Windows 98
b. Windows ME
c. Windows 7
d. Windows 2000
- In which registry hive would we find artifacts relating to USB devices?
a. NT USER.DAT
b. SYSTEM
c. SOFTWARE
d. SECURITY
The answers can be found in the rear of the book under Assessments.