Exam 312-49v11 Topic 11 Question 113 Discussion

Actual exam question for EC-COUNCIL's 312-49v11 exam
Question #: 113
Topic #: 11
During a forensic investigation of a compromised Windows system, Investigator Sarah is tasked with extracting artifacts related to the system'spagefile.sys. She needs to navigate through the registry to locate this specific information. Which of the following registry paths should Sarah examine to extract pagefile.sys artifacts from the system?

Suggested Answer: D Vote an answer

According to theCHFI v11 Operating System Forensicsmodule, the Windowspagefile.sysis a critical forensic artifact because it serves as virtual memory and may contain remnants of sensitive data such as credentials, command history, decrypted content, fragments of documents, and even portions of malicious code that were previously resident in RAM. As a result, understanding where pagefile-related configuration data is stored in the Windows Registry is essential for forensic investigators.
The registry path
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management is the correct location where Windows stores configuration values related tovirtual memory management, including thePagingFilesvalue. This value specifies the location, size, and behavior of the pagefile.sys on the system. CHFI v11 explicitly references this registry key when discussingmemory artifacts, virtual memory analysis, and Windows memory forensics.
The other options are not relevant to pagefile analysis. TheCurrentVersionkey stores OS version details, ControlSet001\Control\Windowscontains general system control settings, andActiveComputerNameonly identifies the system hostname. None of these paths contain pagefile configuration data.
Therefore, to extract and validate artifacts related topagefile.sys, Investigator Sarah must examine HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management, makingOption Dthe correct and CHFI v11-verified answer.

by Gemma at Sep 09, 2026, 09:52 AM

Limited Time Offer

15%

Off

Get Premium 312-49v11 Questions as Interactive Self Test Engine or PDF

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Nick name: Submit Cancel
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
0
0
0
10