Computer Hacking Forensic Investigator (CHFI v10) — Question 374

Which of the following statements is TRUE with respect to the Registry settings in the user start-up folder HKEY_CURRENT_USER\Software\Microsoft\Windows
\CurrentVersion\RunOnce\

Answer options

• A. All the values in this subkey run when specific user logs on, as this setting is user-specific
• B. The string specified in the value run executes when user logs on
• C. All the values in this key are executed at system start-up
• D. All values in this subkey run when specific user logs on and then the values are deleted

Correct answer: D

Explanation

The correct answer is D because the RunOnce key is designed to execute commands or applications only once at the user's next logon and then delete those entries. Option A is incorrect as it does not mention the deletion, B is misleading because it implies it runs every time without deletion, and C is wrong since the entries do not run at system start-up but rather at user logon.