Computer Hacking Forensic Investigator (CHFI v10) — Question 330

Which of the following Windows-based tool displays who is logged onto a computer, either locally or remotely?

Answer options

• A. Tokenmon
• B. PSLoggedon
• C. TCPView
• D. Process Monitor

Correct answer: B

Explanation

The correct answer, PSLoggedon, is specifically designed to display users logged into a computer. Tokenmon does not provide this functionality, while TCPView is focused on TCP connections, and Process Monitor is used for monitoring file system and registry activity, not user sessions.