ESTUDY
SANS 500 LATEST EXAM QUESTIONS AND
VERIFIED ANSWERS GRADED A+ WITH
RATIONALES
1. Why is it important to collect volatile data during incident response?
a) To ensure the system is powered off
b) To prevent the system from rebooting
c) Information could be lost if the system is powered off or rebooted
d) To speed up the investigation process
Rationale: Volatile data resides in RAM and is lost when the system is powered off or rebooted,
making it critical to collect during incident response.
2. You are responding to an incident. The suspect was using his Windows Desktop Computer
with Firefox and "Private Browsing" enabled. The attack was interrupted when it was
detected, and the browser windows are still open. What can you do to capture the most in-
depth data from the suspect's browser session?
a) Collect the browser history
b) Analyze the cookies
c) Collect the contents of the computer's RAM
d) Check the browser cache
Rationale: Since the browser windows are still open, the most in-depth data (e.g., active session
data) resides in RAM.
3. How is a user mapped to contents of the Recycle Bin?
a) Username
b) MAC address
c) SID (Security Identifier)
d) IP address
Rationale: The Recycle Bin uses the user's SID to map files to specific users.
4. How does PhotoRec recover deleted files from a host?
a) By analyzing file metadata
b) By searching free space looking for file signatures that match specific file types
c) By restoring files from backups
d) By decrypting encrypted files
Rationale: PhotoRec scans free space on the disk for file signatures to recover deleted files.
5. You are responding to an incident in progress on a workstation. Why is it important to check
the presence of encryption on the suspect workstation before turning it off?
a) To avoid data corruption
, ESTUDY
b) Data on mounted volumes and decryption keys stored as volatile data may be lost
c) To prevent the system from crashing
d) To ensure the system is not locked
Rationale: Encryption keys and mounted volumes are stored in volatile memory and may be lost
if the system is powered off.
6. How can cookies.sqlite be linked to a specific user account?
a) By analyzing the browser history
b) The DB file is stored in the corresponding profile folder
c) By checking the system logs
d) By examining the Recycle Bin
Rationale: The cookies.sqlite file is stored in the user's profile folder, linking it to a specific
account.
7. You are reviewing the contents of a Windows shortcut [.lnk file] pointing to C:\SANS.JPG.
Which of the following metadata can you expect to find?
a) The creation time of C:\SANS.JPG
b) The last access time of C:\SANS.JPG
c) The file size of C:\SANS.JPG
d) The file owner of C:\SANS.JPG
Rationale: LNK files store metadata such as the last access time of the target file.
8. Which of the following must you remember when reviewing Windows registry data in your
timeline?
a) Registry keys store creation, access, and deletion timestamps
b) Registry keys store only a 'LastWrite' timestamp and do not indicate when they were
created, accessed, or deleted
c) Registry keys are always encrypted
d) Registry keys cannot be modified
Rationale: Registry keys only record the 'LastWrite' timestamp, not creation, access, or deletion
times.
9. What information can be deduced by the following artifact?
System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces
a) The IP address of the system
b) If an interface GUID was used to connect to the internet over 3G
c) The MAC address of the network adapter
d) The default gateway
Rationale: This registry path contains information about network interfaces, including their
GUIDs and connection methods.
10. Which part of the LNK file reveals the shell path to the target file?
a) Header
SANS 500 LATEST EXAM QUESTIONS AND
VERIFIED ANSWERS GRADED A+ WITH
RATIONALES
1. Why is it important to collect volatile data during incident response?
a) To ensure the system is powered off
b) To prevent the system from rebooting
c) Information could be lost if the system is powered off or rebooted
d) To speed up the investigation process
Rationale: Volatile data resides in RAM and is lost when the system is powered off or rebooted,
making it critical to collect during incident response.
2. You are responding to an incident. The suspect was using his Windows Desktop Computer
with Firefox and "Private Browsing" enabled. The attack was interrupted when it was
detected, and the browser windows are still open. What can you do to capture the most in-
depth data from the suspect's browser session?
a) Collect the browser history
b) Analyze the cookies
c) Collect the contents of the computer's RAM
d) Check the browser cache
Rationale: Since the browser windows are still open, the most in-depth data (e.g., active session
data) resides in RAM.
3. How is a user mapped to contents of the Recycle Bin?
a) Username
b) MAC address
c) SID (Security Identifier)
d) IP address
Rationale: The Recycle Bin uses the user's SID to map files to specific users.
4. How does PhotoRec recover deleted files from a host?
a) By analyzing file metadata
b) By searching free space looking for file signatures that match specific file types
c) By restoring files from backups
d) By decrypting encrypted files
Rationale: PhotoRec scans free space on the disk for file signatures to recover deleted files.
5. You are responding to an incident in progress on a workstation. Why is it important to check
the presence of encryption on the suspect workstation before turning it off?
a) To avoid data corruption
, ESTUDY
b) Data on mounted volumes and decryption keys stored as volatile data may be lost
c) To prevent the system from crashing
d) To ensure the system is not locked
Rationale: Encryption keys and mounted volumes are stored in volatile memory and may be lost
if the system is powered off.
6. How can cookies.sqlite be linked to a specific user account?
a) By analyzing the browser history
b) The DB file is stored in the corresponding profile folder
c) By checking the system logs
d) By examining the Recycle Bin
Rationale: The cookies.sqlite file is stored in the user's profile folder, linking it to a specific
account.
7. You are reviewing the contents of a Windows shortcut [.lnk file] pointing to C:\SANS.JPG.
Which of the following metadata can you expect to find?
a) The creation time of C:\SANS.JPG
b) The last access time of C:\SANS.JPG
c) The file size of C:\SANS.JPG
d) The file owner of C:\SANS.JPG
Rationale: LNK files store metadata such as the last access time of the target file.
8. Which of the following must you remember when reviewing Windows registry data in your
timeline?
a) Registry keys store creation, access, and deletion timestamps
b) Registry keys store only a 'LastWrite' timestamp and do not indicate when they were
created, accessed, or deleted
c) Registry keys are always encrypted
d) Registry keys cannot be modified
Rationale: Registry keys only record the 'LastWrite' timestamp, not creation, access, or deletion
times.
9. What information can be deduced by the following artifact?
System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces
a) The IP address of the system
b) If an interface GUID was used to connect to the internet over 3G
c) The MAC address of the network adapter
d) The default gateway
Rationale: This registry path contains information about network interfaces, including their
GUIDs and connection methods.
10. Which part of the LNK file reveals the shell path to the target file?
a) Header
