SANS 500 ACTUAL EXAM NEWEST 2025 COMPLETE 200
QUESTIONS AND CORRECT DETAILED ANSWERS (VERIFIED
ANSWERS) |ALREADY GRADED A+||BRAND NEW VERSION!!
You are reviewing the contents of a Windows shortcut [.Ink file] pointing to C:\SANS.JPG. Which of the
following metadata can you expect to find? - CORRECT ANSWERS-The last access time of C:\
SANS.JPG
Which of the following must you remember when reviewing Windows registry data in your timeline -
CORRECT ANSWERS-Registry keys store only a 'LastWrite' time stamp and do not indicate
when they were created, accessed or deleted
What information can be deduced by the following artifact? System\CurrentControlSet\Services\Tcpip\
Parameters\Interfaces - CORRECT ANSWERS-If an interface GUID was used to connect to the
internet over 3G
Which part of the LNK file reveals the shell path to the target file - CORRECT ANSWERS-PIDL -
The PIDL section of a LNK file, follow the header, it contains a shell path (a PIDL0 to the target file
In addition to the Web Notes Folder, which location contains Web Notes browser artifacts? -
CORRECT ANSWERS-Spartan.edb
Which event will create a new directory in C:\System Volume Information\? - CORRECT
ANSWERS-Software installation. There are several ways to create a new volume shadow copy -
Software installation, System snapshot, Manual snapshot
You are examining an image of a Windows system. In the C:\Windows\Prefetch directory you find an
entry for "EvilBin.Exe". Assuming the file was legitimately created by the operating system, what does
this file's existence mean to you, as the forensic investigator? - CORRECT ANSWERS-
EvilBin.Exe has been run at least once on this system
What does the unique GUID assigned to each sub-key of the UserAssist registry entry represent? -
CORRECT ANSWERS-Method used to execute and application
, Which is the advantage offered by server-based e-mail forensic tools when compared to standard
forensic suites? - CORRECT ANSWERS-They allow simultaneous searches across multiple user
accounts
Which Windows 7 event log records installation and update information for Windows security updates
and patches - CORRECT ANSWERS-Setup.log records installation and update information on
all applications
You are participating in an e-mail investigation for a company using Microsoft Exchange with Outlook
clients. Which of the following would reduce the results returned in a keyword search of a user's
mailbox? - CORRECT ANSWERS-The organization's email clients have S/MIME support
enabled
Network logs show that Bob accessed \\10.10.23.47\Financial\Salary two weeks past. Bob claims he
never intentionally went to the network share, that he must've clicked on a link that mapped to that
location. Which registry key on Bob's host will show if he knew the network location of the salary folder?
- CORRECT ANSWERS-TypePaths
Which local folder stores the Cookies DB in Chrome version 96 and above - CORRECT
ANSWERS-Network
Which of the following is an example of volatile data - CORRECT ANSWERS-Open files -
Current and running apps. on a workstation are volatile and all date will be lost if the device is powered
off
What artifact(s) will be created by Windows 10 when a user opens an office document from a USB drive
using Explorer - CORRECT ANSWERS-Two LNK files are created in C:\Users\<user>\AppData\
Roaming\Microsoft\Windows\Recent
You are examining the contents of a Windows Shortcut(.INK file) pointing to C:\Sans.JPG. Which of the
following metadata can you expect to find? - CORRECT ANSWERS-The last acces time of C:\
SANS.JPG
An analyst is collecting Skype logs from a Windows 10 host. What directory should he copy? -
CORRECT ANSWERS-C:\Users\<user>\AppData\Roaming\Skype\<skype-name>
QUESTIONS AND CORRECT DETAILED ANSWERS (VERIFIED
ANSWERS) |ALREADY GRADED A+||BRAND NEW VERSION!!
You are reviewing the contents of a Windows shortcut [.Ink file] pointing to C:\SANS.JPG. Which of the
following metadata can you expect to find? - CORRECT ANSWERS-The last access time of C:\
SANS.JPG
Which of the following must you remember when reviewing Windows registry data in your timeline -
CORRECT ANSWERS-Registry keys store only a 'LastWrite' time stamp and do not indicate
when they were created, accessed or deleted
What information can be deduced by the following artifact? System\CurrentControlSet\Services\Tcpip\
Parameters\Interfaces - CORRECT ANSWERS-If an interface GUID was used to connect to the
internet over 3G
Which part of the LNK file reveals the shell path to the target file - CORRECT ANSWERS-PIDL -
The PIDL section of a LNK file, follow the header, it contains a shell path (a PIDL0 to the target file
In addition to the Web Notes Folder, which location contains Web Notes browser artifacts? -
CORRECT ANSWERS-Spartan.edb
Which event will create a new directory in C:\System Volume Information\? - CORRECT
ANSWERS-Software installation. There are several ways to create a new volume shadow copy -
Software installation, System snapshot, Manual snapshot
You are examining an image of a Windows system. In the C:\Windows\Prefetch directory you find an
entry for "EvilBin.Exe". Assuming the file was legitimately created by the operating system, what does
this file's existence mean to you, as the forensic investigator? - CORRECT ANSWERS-
EvilBin.Exe has been run at least once on this system
What does the unique GUID assigned to each sub-key of the UserAssist registry entry represent? -
CORRECT ANSWERS-Method used to execute and application
, Which is the advantage offered by server-based e-mail forensic tools when compared to standard
forensic suites? - CORRECT ANSWERS-They allow simultaneous searches across multiple user
accounts
Which Windows 7 event log records installation and update information for Windows security updates
and patches - CORRECT ANSWERS-Setup.log records installation and update information on
all applications
You are participating in an e-mail investigation for a company using Microsoft Exchange with Outlook
clients. Which of the following would reduce the results returned in a keyword search of a user's
mailbox? - CORRECT ANSWERS-The organization's email clients have S/MIME support
enabled
Network logs show that Bob accessed \\10.10.23.47\Financial\Salary two weeks past. Bob claims he
never intentionally went to the network share, that he must've clicked on a link that mapped to that
location. Which registry key on Bob's host will show if he knew the network location of the salary folder?
- CORRECT ANSWERS-TypePaths
Which local folder stores the Cookies DB in Chrome version 96 and above - CORRECT
ANSWERS-Network
Which of the following is an example of volatile data - CORRECT ANSWERS-Open files -
Current and running apps. on a workstation are volatile and all date will be lost if the device is powered
off
What artifact(s) will be created by Windows 10 when a user opens an office document from a USB drive
using Explorer - CORRECT ANSWERS-Two LNK files are created in C:\Users\<user>\AppData\
Roaming\Microsoft\Windows\Recent
You are examining the contents of a Windows Shortcut(.INK file) pointing to C:\Sans.JPG. Which of the
following metadata can you expect to find? - CORRECT ANSWERS-The last acces time of C:\
SANS.JPG
An analyst is collecting Skype logs from a Windows 10 host. What directory should he copy? -
CORRECT ANSWERS-C:\Users\<user>\AppData\Roaming\Skype\<skype-name>
