SANS 500 STUDY GUIDE ANSWERS AND QUESTIONS
SET A+
✔✔Modern Standby (MS) - ✔✔Makes computers operate more like mobile devices by
delivering low-power consumption and enables low-power communications (Wi-Fi,
mobile broadband, and Ethernet) to receive essential communication while reducing the
time for the computer to wake and be fully operational. This extends the life of RAM
information beyond reboot and even extended powered-off states because RAM is
being saved to the hibernation file. Improves upon Connected Standby.
✔✔MountedDevices - ✔✔This key is important to tracking physical devices plugged into
the Windows OS because it incorporates the drive signature and the partition location
into the key.
✔✔MRU / MRULists - ✔✔Key values that are responsible for keeping track of the most
recent additions to a registry key so the key data can determine the order in which the
data was added to the key. This will aid in determining the order of activity for a specific
artifact and prove user interaction. They are responsible for the drop-down menus that
appear whenever you type something in Internet Explorer, keywords, and other terms in
the auto-complete feature.
✔✔Mass Storage Class (MSC) - ✔✔Allows mounting of a device's storage area as
removable media and provides direct access to sectors of data for reading and writing.
The mounting occurs on a physical level. Primarily where intellectual property theft
occurs. Ex: external drives, USB drives, MP3 players
✔✔Picture Transfer Protocol (PTP) - ✔✔Only deals with images, videos, and their
associated metadata. Does not provide support for transferring other file types. Allows
only a unidirectional transfer of files (from the device to the computer). Mounting occurs
on a logical level, meaning you cannot see the underlying filesystem structure for the
devices. Ex: Cameras, scanners, printers
, ✔✔Media Transfer Protocol (MTP) - ✔✔Improvement to PTP partly in that it supports a
variety of file types and is bidirectional. However, it is not possible to see the underlying
filesystem structure, like PTP.
✔✔Network Action Predictor - ✔✔Records letter by letter what was typed, what was
prefetched, ad how often the browser was correct in anticipating what site the user
ultimately was looking for.
✔✔Network Location Awareness (NLA) - ✔✔Designed to aid the user in identifying
where the computer might be connected to adjusting the firewall settings. For each
network the PC is connected to, NLA aggregates the network information available and
creates a network profile.
✔✔NTFS - ✔✔Designed to be a robust and feature-full filesystem that can do a lot more
than FAT. Makes transaction logging and is able to track all the files that have changed
on the system via a USN Journal or Change Journal. Also has robust security controls
to prevent users from opening files they aren't allowed to.
✔✔NTUSER.DAT - ✔✔Contains the configuration and environment settings, which
includes a slew of identifiable data pertaining to user activity. Contains all the keys
related to the specific user, found in HKEY_CURRENT_USER.
✔✔Oalerts - ✔✔Triggered any time Office displays a dialog alert to the user. This helps
identify file interaction and alerts generated by Microsoft products. Only records
information when Office is forced to show the user a dialog message.
✔✔Object Access Events - ✔✔Can give the analyst very detailed information about
when critical resources are accessed by what user account and what actions were
performed on them.
✔✔On-Demand - ✔✔Provides a means to recover a complete copy of a file that
originally would only be present at the cloud provider when cloud applications cache on-
demand files locally.
✔✔Online Registry - ✔✔When you execute regedit, you will see registry hives
presented properly by their formal names (HKEY_CURRENT_USER for example).
✔✔Offline Registry - ✔✔When working offline, the registry files will need to be manually
loaded into a registry viewer and examined, like Registry Explorer. Everything looks the
same except the formal name is now missing and the parent directory is now showing
the file you opened (NTUSER.DAT instead of HKEY_CURRENT_USER for example).
✔✔OpenSaveMRU - ✔✔Tracks files that have been opened or saved within a Windows
shell dialog box. This includes web browser (like IE and Firefox) and commonly used
apps. It is also responsible for tracking auto-complete terms for that same dialog box.
SET A+
✔✔Modern Standby (MS) - ✔✔Makes computers operate more like mobile devices by
delivering low-power consumption and enables low-power communications (Wi-Fi,
mobile broadband, and Ethernet) to receive essential communication while reducing the
time for the computer to wake and be fully operational. This extends the life of RAM
information beyond reboot and even extended powered-off states because RAM is
being saved to the hibernation file. Improves upon Connected Standby.
✔✔MountedDevices - ✔✔This key is important to tracking physical devices plugged into
the Windows OS because it incorporates the drive signature and the partition location
into the key.
✔✔MRU / MRULists - ✔✔Key values that are responsible for keeping track of the most
recent additions to a registry key so the key data can determine the order in which the
data was added to the key. This will aid in determining the order of activity for a specific
artifact and prove user interaction. They are responsible for the drop-down menus that
appear whenever you type something in Internet Explorer, keywords, and other terms in
the auto-complete feature.
✔✔Mass Storage Class (MSC) - ✔✔Allows mounting of a device's storage area as
removable media and provides direct access to sectors of data for reading and writing.
The mounting occurs on a physical level. Primarily where intellectual property theft
occurs. Ex: external drives, USB drives, MP3 players
✔✔Picture Transfer Protocol (PTP) - ✔✔Only deals with images, videos, and their
associated metadata. Does not provide support for transferring other file types. Allows
only a unidirectional transfer of files (from the device to the computer). Mounting occurs
on a logical level, meaning you cannot see the underlying filesystem structure for the
devices. Ex: Cameras, scanners, printers
, ✔✔Media Transfer Protocol (MTP) - ✔✔Improvement to PTP partly in that it supports a
variety of file types and is bidirectional. However, it is not possible to see the underlying
filesystem structure, like PTP.
✔✔Network Action Predictor - ✔✔Records letter by letter what was typed, what was
prefetched, ad how often the browser was correct in anticipating what site the user
ultimately was looking for.
✔✔Network Location Awareness (NLA) - ✔✔Designed to aid the user in identifying
where the computer might be connected to adjusting the firewall settings. For each
network the PC is connected to, NLA aggregates the network information available and
creates a network profile.
✔✔NTFS - ✔✔Designed to be a robust and feature-full filesystem that can do a lot more
than FAT. Makes transaction logging and is able to track all the files that have changed
on the system via a USN Journal or Change Journal. Also has robust security controls
to prevent users from opening files they aren't allowed to.
✔✔NTUSER.DAT - ✔✔Contains the configuration and environment settings, which
includes a slew of identifiable data pertaining to user activity. Contains all the keys
related to the specific user, found in HKEY_CURRENT_USER.
✔✔Oalerts - ✔✔Triggered any time Office displays a dialog alert to the user. This helps
identify file interaction and alerts generated by Microsoft products. Only records
information when Office is forced to show the user a dialog message.
✔✔Object Access Events - ✔✔Can give the analyst very detailed information about
when critical resources are accessed by what user account and what actions were
performed on them.
✔✔On-Demand - ✔✔Provides a means to recover a complete copy of a file that
originally would only be present at the cloud provider when cloud applications cache on-
demand files locally.
✔✔Online Registry - ✔✔When you execute regedit, you will see registry hives
presented properly by their formal names (HKEY_CURRENT_USER for example).
✔✔Offline Registry - ✔✔When working offline, the registry files will need to be manually
loaded into a registry viewer and examined, like Registry Explorer. Everything looks the
same except the formal name is now missing and the parent directory is now showing
the file you opened (NTUSER.DAT instead of HKEY_CURRENT_USER for example).
✔✔OpenSaveMRU - ✔✔Tracks files that have been opened or saved within a Windows
shell dialog box. This includes web browser (like IE and Firefox) and commonly used
apps. It is also responsible for tracking auto-complete terms for that same dialog box.
