Computer Hacking Forensic Investigator (CHFI v10) — Question 441

Which part of the Windows Registry contains the user's password file?

Answer options

• A. HKEY_LOCAL_MACHINE
• B. HKEY_CURRENT_CONFIGURATION
• C. HKEY_USER
• D. HKEY_CURRENT_USER

Correct answer: A

Explanation

The correct answer is A, HKEY_LOCAL_MACHINE, because it is the section that stores global settings and system-wide information, including user password data. The other options do not specifically contain user password files; HKEY_CURRENT_USER pertains to the currently logged-in user's settings, while HKEY_USER contains information about all user profiles, and HKEY_CURRENT_CONFIGURATION pertains to the current hardware profile.