Computer Hacking Forensic Investigator (CHFI v10) — Question 94

What is kept in the following directory? HKLM\SECURITY\Policy\Secrets

Answer options

• A. Cached password hashes for the past 20 users
• B. Service account passwords in plain text
• C. IAS account names and passwords
• D. Local store PKI Kerberos certificates

Correct answer: B

Explanation

The correct answer is B because the HKLM\SECURITY\Policy\Secrets directory contains service account passwords stored in plain text, which can be accessed by users with appropriate permissions. The other options are incorrect as this directory does not store cached password hashes, IAS account credentials, or PKI certificates.