312-49 Question #55: Real Exam Question with Answer & Explanation

The correct answer is A: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Currentversion \ProfileList. Security Identifiers (SIDs) for user accounts are stored in the Windows Registry under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList. Each subkey under ProfileList is named with the user's SID and contains values such as 'ProfileImagePath', which map

Submitted by krish.m· Apr 18, 2026Disk Forensics

Question

Microsoft Security IDs are available in Windows Registry Editor. The path to locate IDs in Windows 7 is:

Options

AHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Currentversion \ProfileList
BHKEY_LOCAL_MACHlNE\SOFTWARE\Microsoft\Windows NT\CurrentVersion \NetworkList
CHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentsVersion \setup
DHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule

Explanation

Security Identifiers (SIDs) for user accounts are stored in the Windows Registry under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList. Each subkey under ProfileList is named with the user's SID and contains values such as 'ProfileImagePath', which maps the SID to the corresponding user profile folder. This is a critical location for forensic investigators to correlate SIDs (found in event logs, ACLs, etc.) back to specific user accounts. The other registry paths listed serve different purposes (network lists, setup data, scheduled tasks).

Topics

#Windows Registry#Security IDs#User Profiles#Windows 7

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice Browse All 312-49 Questions