312-49 Question #503: Real Exam Question with Answer & Explanation

The correct answer is A: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory. The Windows page file (pagefile.sys) configuration is stored in the registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management. The key value 'PagingFiles' within this path specifies the location and size settings for the page file. From a f

Submitted by valeria.br· Apr 18, 2026Disk Forensics

Question

Pagefile.sys is a virtual memory file used to expand the physical memory of a computer. Select the registry path for the page file:

Options

AHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory
BHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\System
CHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Device
DHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory

Explanation

The Windows page file (pagefile.sys) configuration is stored in the registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management. The key value 'PagingFiles' within this path specifies the location and size settings for the page file. From a forensic perspective, the page file is significant because it may contain remnants of sensitive data (passwords, encryption keys, document contents) that were in RAM and paged out to disk. Note that options A and D appear identical in this question â€” both are correct as written, with the full path ending in 'Memory Management'.

Topics

#Pagefile.sys#Windows Registry#Virtual Memory#OS Configuration

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice Browse All 312-49 Questions