Computer Hacking Forensic Investigator (CHFI) — Question 63

What is kept in the following directory? HKLM\SECURITY\Policy\Secrets

Answer options

• A. Cached password hashes for the past 20 users
• B. Service account passwords in plain text
• C. IAS account names and passwords
• D. Local store PKI Kerberos certificates

Correct answer: B

Explanation

The correct answer is B, as the HKLM\SECURITY\Policy\Secrets directory is known to contain service account passwords stored in plain text. Options A, C, and D are incorrect as they refer to different types of data not associated with that specific directory.