GCFA · Question #45
On which of the following locations does the Windows NT/2000 operating system contain the SAM, SAM.LOG, SECURITY.LOG, APPLICATION.LOG, and EVENT.LOG files?
The correct answer is C. \%Systemroot%system32config. Windows NT/2000 stores critical security and event log files in the system32\config subdirectory under the system root.
Question
On which of the following locations does the Windows NT/2000 operating system contain the SAM, SAM.LOG, SECURITY.LOG, APPLICATION.LOG, and EVENT.LOG files?
Options
- A%Systemroot%system32
- B%Systemroot%profiles
- C%Systemroot%system32config
- D%Systemroot%help
How the community answered
(26 responses)- A8% (2)
- B15% (4)
- C73% (19)
- D4% (1)
Why each option
Windows NT/2000 stores critical security and event log files in the system32\config subdirectory under the system root.
%SystemRoot%\system32 is the parent directory containing system executables and DLLs, not the config subdirectory where registry hives and log files reside.
%SystemRoot%\profiles stores user profile directories, not system security databases or event logs.
The %SystemRoot%\system32\config directory is the designated location for the SAM (Security Account Manager) database and its log, along with SECURITY, APPLICATION, and EVENT log files. This path houses the registry hive files that Windows loads at boot and uses for authentication and auditing. Accessing or backing up these files requires elevated privileges because they are locked by the OS while running.
%SystemRoot%\help contains Windows help files and documentation, not security or log database files.
Concept tested: Windows SAM and log file storage location
Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/security-audit-policy-settings
Topics
Community Discussion
No community discussion yet for this question.