- | P a g e
SANS 500 ACTUAL EXAM NEWEST 2025
COMPLETE 200 QUESTIONS AND CORRECT
DETAILED ANSWERS (VERIFIED ANSWERS)
|ALREADY GRADED A+ ||BRAND NEW
VERSION!!
Which is the advantage offered by server-based e-mail forensic tools when compared to standard forensic suites? - ANSWER- They allow simultaneous searches across multiple user accounts
Which Windows 7 event log records installation and update information for Windows security updates and patches - ANSWER-Setup.log records installation and update information on all applications
You are participating in an e-mail investigation for a company using Microsoft Exchange with Outlook clients. Which of the following would reduce the results returned in a keyword search of a user's mailbox? - ANSWER-The organization's email clients have S/MIME support enabled
- / 4
- | P a g e
Network logs show that Bob accessed \\10.10.23.47\Financial\Salary two weeks past. Bob claims he never intentionally went to the network share, that he must've clicked on a link that mapped to that location. Which registry key on Bob's host will show if he knew the network location of the salary folder? - ANSWER-TypePaths
Which local folder stores the Cookies DB in Chrome version 96 and above - ANSWER-Network
Which of the following is an example of volatile data - ANSWER-Open files - Current and running apps. on a workstation are volatile and all date will be lost if the device is powered off
What artifact(s) will be created by Windows 10 when a user opens an office document from a USB drive using Explorer - ANSWER-Two LNK files are created in
C:\Users\\AppData\Roaming\Microsoft\Windows\Recent
Which of the following records a 'last write time' stored typically in UTC - ANSWER-A change to a registry key value
- / 4
- | P a g e
What is the minimum level of access a user would need to modify the system time on a Windows 10 workstation - ANSWER-Administrator
An investigation involves a Windows user who is alleged to have violated Internet-use policy. The user uninstalled Firefox in order to hide their activity. Which approach can recover browser artifacts? - ANSWER-Analyze places.sqlite
What can be determined by analyzing any subkeys and their value(s) in the following path?Software\Microsoft\Windows\CurrentVersion\CapabilityAccess Manager\ConsentStorage\
You have been tasked with examining a .OST file as part of an investigation. Which of the following is the best way to review content in the file? - ANSWER-Run the free tool ost2pst.exe and convert to a .PST file, then open in Microsoft Outlook.
- / 4
- | P a g e
Which of the following occurs while using InPrivate mode of the Edge browser - ANSWER-Persistent cookies are stored in temporary memory like session cookies until the session ends.
Which files inside of the Windows Vista/Win 7 recycle bin contain the actual file recovery data for a deleted file -
ANSWER-$R
Note: $I contain the original path and name as well the delete
date and time
Which Windows 7 event log would be most likely to contain information regarding a third-party anti-virus program's deletion of malicious software on a system? - ANSWER-Application log
Which of the following Types of info. can be found in the Firefox cache? - ANSWER-The HTTP header from a visited website
Which of the following occurs to the space in the Windows registry when a key is deleted? - ANSWER-Unallocated and freed up for new data
- / 4