Clarification on Section 7 Question 8

Online Training
1

Regarding,

The spelling of the executable file “truecrype.exe” in the question is correct. Added a small bit of extra clarification to the question, but the spelling in the question is correct.

If this was indeed how you wanted it spelled in the interesting files rule creation then the spelling in the lab needs to be adjusted to reflect “truecrype.exe” and not “truecrypt.exe”

2

The intention of the interesting file rule is to preset known file names and flag them if they are found. The user would normally enter truecrypt.exe because that is what they’d expect to find if TrueCrypt was on the system.

It points out the limitations of relying on file names…

1 Like