A Computer Hacking Forensic Investigator (CHFI) is examining a compromised Macintosh computer. The system was found to be missing the pre-linked kernel at /System/Library/Caches/com.apple.kernelcaches. What is the next step that the Macintosh boot process will take to load the operating system in such a scenario?

A. The boot loader will attempt to load the mkext cache file containing a set of device drivers

B. The system will initialize the I/O kit and link the loaded drivers to the kernel

C. The boot loader will pass control to BootX (PowerPC) or boot.efi (Intel)

D. The boot loader will search for drivers in the/System/Library/Extensions directory








 

Suggested Answer: D

Community Answer: A



This question is in 312-49V10 EC-Council Computer Hacking Forensic Investigator (CHFI) v10 Exam
For getting EC-Council Computer Hacking Forensic Investigator (CHFI) Certificate







Disclaimers:
The website is not related to, affiliated with, endorsed or authorized by EC-Council. 
Trademarks, certification & product names are used for reference only and belong to EC-Council.
The website does not contain actual questions and answers from EC-Council's Certification Exams.