nerdexam
EC-Council

312-49 · Question #118

You can interact with the Registry through intermediate programs. Graphical user interface (GUI) Registry editors such as Regedit.exe or Regedt32 exe are commonly used as intermediate programs in…

The correct answer is A. HKEY_USERS. The Windows Registry has five valid root keys (hives): HKEY_CLASSES_ROOT (HKCR), HKEY_CURRENT_USER (HKCU), HKEY_LOCAL_MACHINE (HKLM), HKEY_USERS (HKU), and HKEY_CURRENT_CONFIG (HKCC). HKEY_USERS is a legitimate root key that stores user profile settings for all users on the…

Submitted by ashley.k· Apr 18, 2026Disk Forensics

Question

You can interact with the Registry through intermediate programs. Graphical user interface (GUI) Registry editors such as Regedit.exe or Regedt32 exe are commonly used as intermediate programs in Windows 7. Which of the following is a root folder of the registry editor?

Options

  • AHKEY_USERS
  • BHKEY_LOCAL_ADMIN
  • CHKEY_CLASSES_ADMIN
  • DHKEY_CLASSES_SYSTEM

How the community answered

(51 responses)
  • A
    92% (47)
  • B
    2% (1)
  • D
    6% (3)

Explanation

The Windows Registry has five valid root keys (hives): HKEY_CLASSES_ROOT (HKCR), HKEY_CURRENT_USER (HKCU), HKEY_LOCAL_MACHINE (HKLM), HKEY_USERS (HKU), and HKEY_CURRENT_CONFIG (HKCC). HKEY_USERS is a legitimate root key that stores user profile settings for all users on the system. The other options - HKEY_LOCAL_ADMIN, HKEY_CLASSES_ADMIN, and HKEY_CLASSES_SYSTEM - do not exist in the Windows Registry and are fabricated distractors.

Topics

#Windows Registry#Registry Hives#Operating System Fundamentals#System Artifacts

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice