Hi, I\'m currently study registry and need help with some questions below. Quest

Question

Hi, I'm currently study registry and need help with some questions below.

Question 6: Which registry key would you use to discover the SID associated with a particular user? That is, which of the following holds a subkey containing the SID and other information for each user.

A. HK_LOCAL_MACHINESAMDomainsUsers

B. HK_LOCAL_MACHINESAMDomainsAccountUsers

C. HK_LOCAL_MACHINESAMDomainsSIDList

D. HK_LOCAL_MACHINESAMDomainsAccountSIDList

E. HK_LOCAL_MACHINESAMDomainsAccountUsersSIDList

F. None of the above

Question 7: Which of the following web sites contains an easy to use reference of every registry key?

A. MSDN (Microsoft Developer Network)

B. Registrywiki.org

C. Forensicswiki.org

D. Wikipedia.org

E. None of the above

Questions 8: Which of the following is true regarding the different versions of Microsoft Windows and the registry hives, keys and values?

A. There have been no changes to the registry hives, keys or values between versions of Windows

B. Each version of Windows uses a completely different set of registry hives, keys and values

C. Each time Microsoft releases a new version of Windows they have tried to maintain the structure of registry as much as possible. However there have been some situations where changes were necessary and had to be made

D. Each time Microsoft releases a new version of Windows they kept the main registry hives but a majority of the keys change in each release.

Question 13:Which of the main registry hives holds the settings and data for any user that has ever been created on the computer?

A. HKEY_CLASSES_ROOT

B. HKEY_CURRENT_USER

C. HKEY_LOCAL_MACHINE

D. HKEY_USERS

E. HKEY_CURRENT_CONFIG

F. None of the above

Question 15: True or False. All of the information in the HKEY_LOCAL_MACHINE hive is stored in the file WindowsSystem32configSYSTEM file when Windows shuts down.

A. True

B. False

Question 16. True or False. The information in HKEY_CURRENT_CONFIG is actually part of HKEY_LOCAL_MACHINE, so it is not stored in a separate file when Windows shuts down.

A. True

B. False

Question 17: Which of the following is true regarding the data in HKEY_CURRENT_USER? (You can assume Windows Vista and later).

A. The information is always stored in %UserProfile%UsersUserNameNTUser.Dat

B. The information is always stored in %UserProfile%UsersAppDataUserNameNTUser.Dat

C. The information is stored in %UserProfile%UsersUserNameNTUser.Dat unless the user account is an Active Directory (network) account set up for roaming. In this case the information will be stored in the NTUser.Dat in the user

Explanation / Answer

In the Windows Operating System a registry key is an organizational unit in the Windows registry. It is an internal database that the computer uses to store configuration information. It just look like a Window folder, which contains root keys, hkeys etc. The pre-defined key along with its nested subkeys all together is called as a hive.

Question 6:

To discover the SID associated with a particular user the registry key the System Asset manager can be used. It is one of the supporting file for hive. HK_LOCAL_MACHINESAMDomainsAccountUsersSIDList is used to find SID associated with a particular user.

Hence, the correct answer is option E.

Question 7:

The MSDN website provides an easy use of reference to every registry key. This is because the registry key is developed by Microsoft. So, it is easy to use a registry key using MSDN explorer.

Hence, the correct answer is option A.

Question 13:

HKEY_USERS is the hive which holds the settings and data for any new user not created on the computer.

Hence, the correct answer is option D.

Question 17:

HKEY_CURRENT_USER is the hive that stores the settings that are specific to currently logged in user. The user settings are stored in the own files of the user called NTUSER.DAT and USRCLASS.DAT inside the user own Documents and settings folder. A roaming profile is setup from machine to machine. Thus, ths file are stored in: %UserProfile%UsersUserNameAppDataNTUser.Dat

Hence, The current answer is option C.

Related Questions

Navigate

• Browse (All)
• Browse H
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.