Cisco Exam 300-215 Topic 8 Question 69 Discussion

Actual exam question for Cisco's 300-215 exam

Question #: 69
Topic #: 8

An organization uses a Windows 7 workstation for access tracking in one of their physical data centers on which a guard documents entrance/exit activities of all personnel. A server shut down unexpectedly in this data center, and a security specialist is analyzing the case. Initial checks show that the previous two days of entrance/exit logs are missing, and the guard is confident that the logs were entered on the workstation. Where should the security specialist look next to continue investigating this case?

AHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon

BHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\ProfileList

CHKEY_CURRENT_USER\Software\Classes\Winlog

DHKEY_LOCAL_MACHINES\SOFTWARE\Microsoft\WindowsNT\CurrentUser

Show Suggested Answer

Suggested Answer: C, E

by Flo at Feb 14, 2024, 01:48 AM

Limited Time Offer

25%

Off

Get Premium 300-215 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Alverta

20 hours ago

The security specialist should check the CurrentUser registry key. That's where all the important stuff is hidden, right?

upvoted 0 times

...

Joesph

2 days ago

Haha, I bet the guard was too busy chatting with visitors to properly log the entrance/exit activities. Good luck finding those missing logs!

upvoted 0 times

...

Pansy

17 days ago

This is a classic case of missing data! I bet the security specialist will find the logs in the Winlogon registry key. That's where I'd start looking.

upvoted 0 times

...

Micaela

18 days ago

Hmm, I'm not sure the logs would be stored in the registry. Maybe the security specialist should look for log files in the file system instead.

upvoted 0 times

...

Lorrine

19 days ago

The missing logs are definitely in the registry. I'd start by checking the ProfileList to see if the logs were stored in a user profile.

upvoted 0 times

...

Quinn

21 days ago

I'm not sure, but maybe the security specialist should also consider looking at B) HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsNT\\CurrentVersion\\ProfileList for any clues.

upvoted 0 times

...

Tamesha

22 days ago

I agree with Ezekiel, checking the Winlogon registry key could provide valuable information about the missing logs.

upvoted 0 times

...

Ezekiel

30 days ago

I think the security specialist should look at A) HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsNT\\CurrentVersion\\Winlogon next.

upvoted 0 times

...