nerdexam
EC-CouncilEC-Council

312-49 · Question #489

312-49 Question #489: Real Exam Question with Answer & Explanation

Sign in or unlock 312-49 to reveal the answer and full explanation for question #489. The question stem and answer options stay visible for context.

Submitted by joshua94· Apr 18, 2026Disk Forensics

Question

Smith, an employee of a reputed forensic Investigation firm, has been hired by a private organization to investigate a laptop that is suspected to be involved in hacking of organization DC server. Smith wants to find all the values typed into the Run box in the Start menu. Which of the following registry key Smith will check to find the above information?

Options

  • AUserAssist Key
  • BMountedDevices key
  • CRunMRU key
  • DTypedURLs key

Unlock 312-49 to see the answer

You've previewed enough free 312-49 questions. Unlock 312-49 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.

Topics

#Registry forensics#Windows Registry#Run box history#Forensic artifacts
Full 312-49 PracticeBrowse All 312-49 Questions