nerdexam
GIAC

GCFA · Question #120

Which of the following statements about the HKEY_LOCAL_MACHINE registry hive is true?

The correct answer is B. It contains information about the local computer system, including hardware and operating system. HKEY_LOCAL_MACHINE (HKLM) stores system-wide configuration data covering hardware, drivers, and operating system settings that apply to all users on the computer.

File System & Registry Forensics

Question

Which of the following statements about the HKEY_LOCAL_MACHINE registry hive is true?

Options

  • AIt contains the user profile for the user who is currently logged on to the computer.
  • BIt contains information about the local computer system, including hardware and operating system
  • CIt contains configuration data for the current hardware profile.
  • DIt contains data that associates file types with programs and configuration data for COM objects,

How the community answered

(45 responses)
  • A
    7% (3)
  • B
    78% (35)
  • C
    13% (6)
  • D
    2% (1)

Why each option

HKEY_LOCAL_MACHINE (HKLM) stores system-wide configuration data covering hardware, drivers, and operating system settings that apply to all users on the computer.

AIt contains the user profile for the user who is currently logged on to the computer.

The user profile for the currently logged-on user is stored in HKEY_CURRENT_USER, not HKEY_LOCAL_MACHINE.

BIt contains information about the local computer system, including hardware and operating systemCorrect

HKEY_LOCAL_MACHINE is the registry hive that contains all configuration information specific to the local machine, including installed hardware, device drivers, system services, and OS settings. This data is independent of any user account and persists across logins. It is the authoritative source for hardware and system-level configuration on a Windows computer.

CIt contains configuration data for the current hardware profile.

Configuration data for the current hardware profile (e.g., docked vs. undocked) is stored in HKEY_CURRENT_CONFIG, which is a subset of HKLM but not the whole hive.

DIt contains data that associates file types with programs and configuration data for COM objects,

File type associations and COM object configuration data are stored in HKEY_CLASSES_ROOT, which mirrors HKLM\SOFTWARE\Classes.

Concept tested: Windows registry hive HKEY_LOCAL_MACHINE purpose and scope

Source: https://learn.microsoft.com/en-us/windows/win32/sysinfo/hkey-local-machine

Topics

#HKEY_LOCAL_MACHINE#registry hives#Windows registry#system configuration

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCFA Practice