nerdexam
EC-Council

312-49V11 · Question #30

Nora, a forensic investigator, is examining the Windows Registry of a compromised system as part of her investigation into a potential insider threat. She wants to determine which folders were most…

Sign in or unlock 312-49V11 to reveal the answer and full explanation for question #30. The question stem and answer options stay visible for context.

Windows Forensics

Question

Nora, a forensic investigator, is examining the Windows Registry of a compromised system as part of her investigation into a potential insider threat. She wants to determine which folders were most recently accessed by the user. After reviewing the Registry, she discovers that a particular Registry key stores information about the folders the user recently accessed, including the folder names and their paths in the file system. Based on her findings, which of the following Registry keys contains this information?

Options

  • ABagMRU key
  • BMRUListEx key
  • CBags key
  • DNodeSlot value

Unlock 312-49V11 to see the answer

You've previewed enough free 312-49V11 questions. Unlock 312-49V11 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.

Topics

#Windows Registry#BagMRU key#recently accessed folders#insider threat investigation
Full 312-49V11 Practice