CFA-001 practice question 11 of 25
Which root folder (hive) of registry editor contains a vast array of configuration information for the system, including hardware settings and software settings?
Full set: 180 questionsDomain Operating System Forensics
The HKEYLOCALMACHINE (HKLM) hive contains configuration data specific to the local computer, which is applied globally to all users. It serves as the central repository for a vast array of system information, including the hardware configuration (detected devices, drivers, and resources under the HARDWARE and SYSTEM subkeys) and system-wide software settings (under the SOFTWARE subkey). This information is critical for the boot process and system operation, independent of which user is logged on. The settings stored here define the machine's behavior and resources.
A. HKEYUSERS: This hive contains the user-specific configuration profiles for all user accounts on the machine, not the system-wide hardware and software settings.
B. HKEYCURRENTUSER: This is a subkey of HKEYUSERS that points to the profile of the currently logged-on user, containing their personal preferences and settings.
D. HKEY-CURRENTCONFIG: This is a pointer to the current hardware profile within HKEYLOCALMACHINE, not the comprehensive repository for all hardware and software settings.
1. Microsoft Corporation. (2021, September 15). Registry Hives. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/windows/win32/sysinfo/registry-hives.
Section: "Standard Hives". This document explicitly states, "HKEYLOCALMACHINE... Contains configuration information particular to the computer (for any user)." It details the subkeys like HARDWARE, SOFTWARE, and SYSTEM, which directly correspond to the information requested in the question.
2. Russinovich, M. E., Solomon, D. A., & Ionescu, A. (2017). Windows Internals, Part 1 (7th ed.). Microsoft Press.
Chapter 5, "Management Mechanisms," Section: "Registry." This authoritative text describes HKEYLOCALMACHINE as the hive containing the system's non-user-specific configuration database, including the hardware configuration loaded by the kernel and system-wide software settings.
3. Carnegie Mellon University, Software Engineering Institute. (2010). The Windows Registry. CERT Forensics Document.
Section: "Registry Organization." University courseware and technical reports often reference HKLM as the primary location for machine-specific data. This document outlines that HKLM contains "all the configuration data for the local machine," distinguishing it from the user-specific hives.
Keep practicing
Take the free CFA-001 practice test
Ten exam-style questions with answers and explanations, plus the exam facts and study guides.
More questions
Other CFA-001 practice questions
- Question 1Which of the following commands shows you the names of all open shared files on a server …
- Question 2Billy, a computer forensics expert, has recovered a large number of DBX files during fore…
- Question 3Hash injection attack allows attackers to inject a compromised hash into a local session …
- Question 4The Apache server saves diagnostic information and error messages that it encounters whil…
- Question 5First response to an incident may involve three different groups of people, and each will…
- Question 6The Recycle Bin exists as a metaphor for throwing files away, but it also allows user to …
