Exam CS0-002 topic 1 question 370 discussion

How does CompTIA expect us to know this, fuk them

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion contains a list of programs that are automatically executed when the system starts up. These programs are launched regardless of the user who logs into the system. If malware was installed on the system and set to execute automatically at startup, it would be listed in this registry key.

Selected Answer C: HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2: This key will hold information that states which user was logged into Windows® when a specific USB device was connected.

Going with C here. The question states "Company policy prohibits"... meaning Users are not allowed to connected USB/external media. The question does not state that there is a policy that "blocks" usb/external media. The HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 registry key is used to store information about volumes and devices that have been mounted or accessed by the user. It is related to the auto-play functionality in Windows and contains information about drives, storage devices, and volumes that have been connected or accessed.

he registry key "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eventlog\System\iusb3hub" is the most likely location where information related to the insertion or use of USB devices, including portable media, might be recorded. This key is related to event logging in the Windows system, specifically in the "System" event log.

I am surprised by the two symbols "\" that appear in options A, C and D. I think that in these options the branch "<user ID>" has been omitted by mistake (in other dumps I have been able to see the mentioned branch). If this branch is really missing, the correct option would be A as it would allow to know which user carried out the infection. Now, if the "<user ID>" should not appear and the two symbols "\" have been put to confuse, then, the correct answer would be B This is a crazy question

from prior question

anwer: C

duplicate

Answer A

A and B are out. The rest don't see to provide the user information. The question is asking to identify the user.

https://www.examtopics.com/discussions/comptia/view/46829-exam-cs0-002-topic-1-question-126-discussion/

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run