Deck 21: In-Depth Analysis of Windows XP

Question 1

Which of the following is not an edition of Windows XP?

A) Home Edition
B) Server Edition
C) 64-Bit Edition
D) Professional Edition

Answer 1

B

Question 2

Which of the following is not a trend in the development of the Windows operating systems?

A) adding layers of abstraction to increase stability
B) modifying the GUI to make the system more user-friendly
C) removing deprecated components and APIs immediately to improve efficiency
D) extending the operating system to support the latest multimedia and networking technologies

Answer 2

C

Question 3

Windows XP is a ________ -based system.

A) Windows NT
B) DOS
C) Windows 98
D) Windows CE

Answer 3

A

Question 4

________ is a Windows XP design goal inherited from the corporate line of Windows operating systems.

A) A user-friendly GUI
B) Data reliability
C) Advanced multimedia support
D) Hard real time guarantees

Question 5

________ was a new design goal that Microsoft strived to attain in Windows XP.

A) Fast system boot up
B) Hard real time guarantees
C) Linux emulation
D) C2 security certification

Question 6

The purpose of the executive is ________.

A) to interact directly with the hardware and abstract the details of hardware from other kernel-mode components
B) to provide basic system components, such as thread scheduling, interrupt dispatching and exception handling
C) to administer the main operating system subsystems, such as the file system, I/O subsystem and system memory
D) to provide a particular computing environment (such as a Windows or POSIX computing environment) for user-mode threads

Question 7

All architecture-specific code resides in the ________, and hardware-specific code that might differ between systems of the same architecture resides in the ________.

A) HAL; executive
B) microkernel; HAL
C) executive; HAL
D) HAL; microkernel

Question 8

What does the registry store?

A) logs of previous user activity
B) information about other computers on a LAN
C) file system information
D) configuration information

Question 9

What is the registry's logical structure?

A) tree
B) hash map
C) array
D) indexed structure similar to inodes

Question 10

An object's ________ count stores the number of ________ that refer to that object.

A) pointer count; handles and pointers
B) reference count; pointers
C) reference count; handles and pointers
D) pointer count; handles

Question 11

When does the object manager delete an object?

A) When all handles to the object are closed.
B) When the thread that created the object calls the delete function.
C) Objects are never deleted unless system memory is low.
D) When the object's reference count drops to zero.

Question 12

At what IRQL does thread scheduling occur?

A) passive
B) APC
C) DPC/dispatch
D) high

Question 13

The number of device IRQLs (DIRQLs) on a Windows XP system ________.

A) depends on how many interrupts the underlying architecture supports
B) depends on the number of devices connected to the system
C) depends on the edition on Windows XP and user preferences
D) all of the above

Question 14

A thread executes its user-mode asynchronous procedure call (APC) ________.

A) when the thread enters an alertable wait state
B) immediately after the APC is queued, assuming there is a processor running at the passive IRQL
C) once the thread obtains a processor
D) The thread that queues the APC determines this.

Question 15

Which of the following is not a characteristic of an APC?

A) An APC executes in the context of a particular thread.
B) An APC can be queued by a kernel-mode component or a user-mode thread with sufficient access rights.
C) Kernel APCs are organized in a FIFO queue; however, special kernel APCs are placed at the front of the queue.
D) A thread executing an APC cannot be preempted.

Question 16

What is the term for a software interrupt that executes in the context of the currently executing thread?

A) remote procedure call (RPC)
B) local procedure call (LPC)
C) asynchronous procedure call (APC)
D) deferred procedure call (DPC)

Question 17

A thread executing a DPC ________.

A) cannot hold a spin lock
B) cannot access pageable data
C) must return from the DPC after executing for at most one quantum
D) all of the above

Question 18

Why might a kernel-mode component need to create a system thread or queue a work item to a system worker thread?

A) The component must perform work not requested by a user thread (e.g., flushing dirty pages to disk).
B) The component is unable to perform all interrupt processing at an elevated IRQL.
C) The component must share handles with a user-mode process.
D) Both a and b.

Question 19

________ is not a type of system worker thread.

A) Asynchronous
B) Delayed
C) Critical
D) Hypercritical

Question 20

The ________ is/are not contained within a Windows XP process object.

A) handle table
B) virtual address space
C) state of machine registers
D) process attributes (such as a security context and working set size limitations)

Question 21

________ will not cause a process to terminate.

A) A process's parent process terminates.
B) All of process's threads terminate.
C) One of the process's threads directs the process to terminate.
D) The user in whose context the process executes logs off.

Question 22

A fiber is a(n) ________.

A) object that allows developers to group several processes for the purpose of setting limits on the group
B) collection of worker threads that sleep until a request is queued to it, at which point one of the threads awakens and executes the request
C) region of a process's address space that stores thread-specific data
D) unit of execution that is scheduled by the thread that creates it and not by the dispatcher

Question 23

The ________ is not a Windows XP thread state.

A) valid state
B) ready state
C) standby state
D) waiting state

Question 24

What differentiates real-time threads from other Windows XP threads?

A) The only difference is that all real-time threads have a higher priority than other threads.
B) The only difference is that real-time threads receive a longer quantum than other threads.
C) Real-time threads have a higher priority than other threads, and real-time threads' priorities are static, whereas other threads' priorities are dynamic.
D) Real-time threads have a higher priority and receive a longer quantum than other threads.

Question 25

A(n) ________ is not a dispatcher object.

A) event object
B) mutex object
C) semaphore object
D) critical section object

Question 26

Queued spin lock are more advantageous than a normal spin lock because ________.

A) queued spin locks enforce a FIFO ordering of requests, which increases fairness.
B) queued spin locks execute more efficiently than normal spin locks.
C) queued spin locks execute more efficiently than normal spin locks and they enforce a FIFO ordering of requests, which increases fairness.
D) queued spin locks execute more efficiently than normal spin locks, enforce a FIFO ordering of requests (which increases fairness) and can be used in either shared mode (for many readers) or exclusive mode (for one writer).

Question 27

________ is employed by the Windows XP memory manager.

A) Lazy allocation
B) Anticipatory paging
C) Copy-on-write
D) all of the above

Question 28

32-bit Windows XP editions allocate each process a ________GB virtual address space of which ________GB are reserved as system space.

A) 4; 1
B) 4; 2
C) 6; 3
D) 16; 2

Question 29

When translating a virtual address, Windows XP adds the value in the ________ to the first portion of the virtual address-this value serves as the index into the ________. It adds the value at this index to the second portion of the virtual address-this value serves as the index into the ________. Windows XP uses the value at this index to determine which virtual page is being referenced. Once the page is loaded, Windows XP uses the final portion of the virtual address to determine the offset within the page frame to locate the requested data.

A) page directory register; page directory table; page table
B) page directory register; page table; page directory table
C) page directory table; page table; page directory register
D) page table; page directory table; page directory register

Question 30

Which of the following accurately describes the memory allocation process?

A) A process attempts to access a page. If the page is not allocated, the system throws an exception and the VMM prompts the process to commit to indicate that it wants to use the page. If the process confirms, the VMM reserves the page in virtual memory and moves the page into main memory.
B) When a process requires additional memory, it reserves space. As necessary, the process commits its reserved main memory pages to virtual memory. The process can access any committed pages.
C) Upon process creation, the VMM reserves a portion of main memory, called the working set, for that process. When a process attempts to access a page, the VMM determines whether the page is currently in the process's working set. If it is not, the VMM loads the page into main memory, thus committing the page.
D) A process first reserves space in virtual memory. The process commits the page, telling the system to create a mapping between virtual and physical memory, before using the page. When the process accesses the page for the first time (or after it has been replaced), the VMM loads the page into main memory.

Question 31

Windows XP prefetches pages ________.

A) when reading a page from a cluster and when the system is idle
B) every 10 seconds and whenever the system is idle
C) during device initialization and whenever the system is idle
D) when reading a page from a cluster and during device initialization

Question 32

What is the difference between Denning's definition of working set and Windows XP's definition?

A) Denning's working set is the set of pages a process accessed within a certain working set window of process-execution time, whereas Windows XP's definition is any page the process has in main memory.
B) Denning's working set is the set of pages a process accessed during the most recent quantum, whereas Windows XP's definition is any page the process accessed within a certain working set window of process-execution time.
C) Denning's working set is a process's set of pages in main memory, whereas Windows XP's definition is any page the process accessed within a certain working set window of process-execution time.
D) There is no difference because Windows XP complies with all ISO operating system standards.

Question 33

Windows XP's localized least-recently-used page-replacement algorithm is "localized" by ________.

A) time
B) process
C) thread
D) page frame location

Question 34

________ is a file system supported by the default installation of Windows XP.

A) FAT
B) NTFS
C) UDF
D) all of the above

Question 35

________ translate(s) the logical representation of the file system (exposed to applications) to the physical representation of the file system on disk.

A) File system drivers
B) NTFS
C) The master file table (MFT)
D) Compression units

Question 36

File system drivers are implemented for ________.

A) network file systems
B) hard disk file systems
C) file systems on peripheral devices (e.g., floppy disks and DVDs)
D) all of the above

Question 37

________ is a non-resident attribute.

A) A file stored on a non-NTFS volume
B) Metadata describing a file stored on a non-NTFS volume
C) A file attribute that NTFS could not fit on a file's first MFT record and therefore had to place on the file's second or third MFT record
D) A file attribute that NTFS does not store in a file's MFT records

Question 38

A compression unit is a ________.

A) Windows XP user-level subcomponent responsible for compressing NTFS files
B) Windows XP file system filter responsible for compressing NTFS files
C) set of sixteen consecutive clusters that NTFS encrypts or compresses at the same time
D) unit of measurement describing how much of a file has been compressed

Question 39

The ________ interacts with device drivers to fulfill I/O requests.

A) plug and play manager
B) I/O manager
C) power manager
D) I/O worker thread

Question 40

Plug and Play (PnP) is the ________.

A) mechanism that enables a system to dynamically add or remove hardware components and redistribute resources appropriately
B) mechanism that enables a system to dynamically change the power state of a single device or entire system in response to conserve electricity
C) standard for writing device drivers that promotes source-code compatibility among Windows platforms
D) mechanism that enables a system to provide hardware and system information to user processes and allow user processes greater control in device configuration

Question 41

Of these following device drivers in a driver stack for a joystick, which one is a filter driver?

A) PCI bus driver
B) class driver for joystick devices
C) miniclass driver for this specific joystick
D) joystick driver that adds a macro button to the joystick

Question 42

Which of the following statements about how Windows XP services a write I/O request is true?

A) The requesting thread passes an IRP to the I/O manager.
B) The I/O manager queries the target device's availability before it passes the IRP down the driver stack.
C) The I/O manager initializes each driver's location in the I/O stack of the IRP before sending the IRP to the top driver in the driver stack.
D) All drivers, except the lowest-level driver, can register an I/O completion routine for the IRP, which is called once the device finishes servicing the I/O request.

Question 43

Asynchronous I/O available to Windows XP threads can be managed by ________.

A) issuing the I/O request, performing some other processing and waiting on an event object to signal the completion of the I/O
B) performing alertable I/O, in which case a thread issues the I/O request, performs some other processing and then enters an alertable wait state to process an APC associated with the I/O completion
C) using an I/O completion port, enabling another thread that registered with the port and that is waiting for I/O completion packets to process them
D) all of the above.

Question 44

An ISR be written to execute quickly because ________.

A) there can be several devices that interrupt at the same DIRQL, so returning quickly allows the system to determine which device is interrupting and service the interrupt faster.
B) the kernel interrupt handler holds the driver's spin lock while the ISR is executing, preventing other processors from executing some portions of the driver's code, including the ISR.
C) while the ISR is executing, the processor executes at the device's DIRQL, which might mask interrupts from other devices. Returning from the ISR quickly allows the system to maintain high responsiveness to all hardware interrupts.
D) all of the above

Question 45

A(n) ________ for an interrupt stores interrupt-related information, such as the specific DIRQL at which the interrupt executes, the interrupt vector of the interrupt and the address of the ISR.

A) I/O completion routine
B) interrupt object
C) deferred procedure call (DPC)
D) interrupt dispatch table (IDT)

Question 46

Which of the following statements most accurately describes the benefits realized from Windows XP's policy of file caching simply by mapping files into the system's virtual address space?

A) The only advantage is that the physical memory used by the file cache can grow or shrink dynamically, depending on memory needs.
B) The only advantage is that this policy permits Windows XP to maintain separate caches for each mounted file system.
C) The only advantages are that the physical memory used by the file cache can grow or shrink dynamically depending on memory needs, and this policy permits Windows XP to synchronize data access between memory-mapped file access (which goes through the VMM) and traditional file access using read and write (which goes through the file system)
D) This permits physical memory used by the file cache to grow or shrink dynamically, depending on memory needs; this allows Windows XP to maintain separate caches for each mounted file system; and this permits Windows XP to synchronize data access between memory-mapped file access (which goes through the VMM) and traditional file access using read and write (which goes through the file system).

Question 47

Fulfilling an I/O request without generating an IRP or accessing a device is referred to as ________.

A) fast I/O
B) direct I/O
C) buffered I/O
D) neither I/O

Question 48

________ is not an IPC mechanism available to all threads in Windows XP?

A) Mailslots
B) Shared memory
C) Signals
D) The clipboard

Question 49

A ________ pipe supports only synchronous, unidirectional communication between local processes.

A) named
B) stream
C) message-oriented
D) unnamed

Question 50

How does a pipe server for a named pipe support communication with multiple clients?

A) All clients and the pipe server connect to the same pipe object and each client specifies its mode (read, write or duplex).
B) The server creates a separate instance of the pipe for each client so that each client can communicate only with the server (and not other clients). The server must use the same mode for each instance of the pipe.
C) All clients and the pipe server connect to the same pipe object. However, all of the clients must have a mode compatible with that of the pipe server. For example, if the pipe server uses read mode, all clients must use write mode.
D) The server creates a separate instance of the pipe for each client so that each client can communicate only with the server (and not other clients). The server can specify different modes for each instance of the pipe.

Question 51

A(n) ________ provides a method for unidirectional communication between one server process and many client processes.

A) named pipe
B) unnamed pipe
C) region of shared memory
D) mailslot

Question 52

Datagram messages can be broadcast to several mailslots within a single ________.

A) computer
B) network
C) domain
D) process

Question 53

Mapping views of files provides which additional benefit(s) beyond sharing memory?

A) faster random I/O
B) faster sequential I/O
C) more efficient caching
D) all of the above

Question 54

A remote procedure call (RPC) between processes on the same machine is called a(n) _______.

A) local remote procedure call (LRPC)
B) local procedure call (LPC)
C) deferred procedure call (DPC)
D) asynchronous procedure call (APC)

Question 55

The protocol sequence of a binding handle specifies the ________, ________ and ________ protocols for an RPC.

A) endpoint; RPC; transport
B) endpoint; transport; network
C) RPC; transport; network
D) endpoint; RPC; network

Question 56

Threads communicate with COM objects ________.

A) through pointers
B) through COM objects' interfaces
C) by transmitting requests over a pipe to the COM object
D) through globally unique IDs (GUIDs)

Question 57

______ is not a technology built on top of COM technology.

A) object linking and embedding (OLE)
B) ActiveX controls
C) COM+
D) .NET

Question 58

The _____ is a central repository of data accessible to all processes.

A) clipboard
B) system shared memory
C) system pipe
D) ActiveX control

Question 59

When a document ________ an object, it maintains a pointer to the object and receives all changes made to the object by the object's server; when a document ________ an object, it copies the entire object into the document and does not receive changes made to the object by the object's server.

A) associates; controls
B) links; embeds
C) associates; embeds
D) links; controls

Question 60

Which statement does not accurately describe redirectors?

A) Redirectors implement the transport layer and also can implement a portion of the network layer of the TCP/IP protocol stack.
B) Redirectors are kernel-mode file system drivers.
C) Redirectors are responsible for connecting to a server driver to communicate network I/O requests.
D) Redirectors are TDI clients.

Question 61

A CIFS client uses a(n) ________ to obtain exclusive access to a remote file, ensuring that the client can cache data locally and maintain cache coherency.

A) spin lock
B) cache lock
C) opportunistic lock
D) network lock

Question 62

The benefit of using the Network Driver Interface Specification (NDIS) is that ________.

A) each system using NDIS employs the same network and transport protocols, improving interoperability between diverse systems
B) drivers that follow NDIS fulfill all the requirements for network drivers and support plug and play (PnP) by default
C) NDIS hides the differences in network and transport protocols between diverse systems, allowing them to communicate regardless of the protocols they use
D) NDIS drivers are portable because they each implement a standard interface, facilitating driver swapping

Question 63

The purpose of an NDIS miniport driver is to ________.

A) translate packets between different communication media, filter packets and balance loads among several NICs
B) manage a NIC, transmit outgoing data through a NIC and service a NIC's interrupts
C) place data into packets and pass these packets to lower-level drivers
D) send network requests to TDI drivers and implement the application layer of the TCP/IP protocol stack

Question 64

________, ________ and ________ are application-layer protocols supported by Windows XP.

A) WinINET; WinHTTP; CIFS
B) WinINET; NBT; NetBIOS
C) WinHTTP; NetBIOS; CIFS
D) NBT; NetBIOS; CIFS

Question 65

________ is not a feature of Winsock 2.

A) Compatibility with Berkeley sockets
B) Protocol transparency
C) Integration with the Common Internet File System (CIFS)
D) Quality of service (QOS) capabilities, such as reporting information about network condition and the success or failure of socket communication attempts,

Question 66

________ provides directory services for shared objects (e.g., files, printers, services, users, etc.) on a network.

A) Active Directory
B) Lightweight Data Access Protocol (LDAP)
C) Distributed Component Object Model (DCOM)
D) .NET

Question 67

.NET does not include ________.

A) Web services
B) DCOM
C) a programming model
D) servers, such as Windows Server 2003

Question 68

.NET services interoperable and portable because ________.

A) they support COM interfaces
B) clients communicate with .NET servers through native API calls, regardless of whether the service is on the local computer or a remote computer
C) clients communicate with .NET servers using XML messages which any computer can interpret because they are just text (i.e., not language or platform specific)
D) clients and servers of .NET services communicate using IDL, which is The Open Group's Distributed Computing Environment (DCE) standard for RPC interoperability

Question 69

________ allows Windows XP to scale to SMP systems.

A) A multiprocessor scheduling algorithm
B) 64-bit addressing (in 64-bit editions of Windows XP)
C) Spin locks
D) all of the above

Question 70

How do job objects facilitate resource management for servers?

A) A server can group all the processes dedicated to servicing a client's request (or all clients' requests) in a job object and restrict the resources (e.g., processor time and working set size) allocated to those processes.
B) A server can queue work items to a job object, which dispatches one of its dedicated system worker threads to fulfill the request. This frees the server from unnecessarily creating and terminating threads for each client request.
C) A server can register a job object with an I/O completion port. When an I/O for a file associated with the port completes, the job object dispatches one of its dedicated system worker threads to complete I/O processing, freeing the server from this responsibility.
D) all of the above

Question 71

Windows XP Embedded is designed for devices such as ________.

A) cell phones
B) PDAs
C) point-of sales systems
D) laptops

Question 72

Venturcom's RTX does not extend Windows XP and Windows XP Embedded to satisfy hard real time guarantees by ________.

A) never masking real-time interrupts
B) reimplementing sections of the microkernel involved in interrupt dispatching
C) increasing scheduling flexibility by implementing 128 thread priority levels
D) waking threads waiting for a protected resource in priority order rather than FIFO order

Question 73

A(n) ________ comprises a user's credentials on a Windows XP system.

A) password
B) username, password and access token
C) username and password
D) access token

Question 74

The Security Support Provider Interface (SSPI) is a(n) ________.

A) internet service that provides users easy access to technical support for Windows XP security issues
B) interface enabling information to be transmitted between access tokens and security descriptors
C) GUI that enables administrators to create and modify security policies easily
D) protocol that the Local Security Authority (LSA) uses to communicate with Kerberos and NTLM

Question 75

________ is a security principal.

A) Any user, group, service or computer
B) An administrator with the highest security privileges
C) A Microsoft guideline for maintaining security on a Windows XP system
D) An authentication and authorization agent such as Kerberos or NTLM

Question 76

A thread gains access to a resource with a nonempty discretionary access control list (DACL) if ________.

A) the first ACE (access control entry) in the resource's DACL that matches one of the SIDs in the thread's access token grants that security principal access to the resource
B) no ACE in the resource's DACL denies access to any of the SIDs in the thread's access token
C) one of the ACEs in the resource's DACL that matches one of the SIDs in the thread's access token grants that security principal access to the resource
D) for each SID in the thread's access token, there is an ACE in the resource's DACL that grants access to the resource

Question 77

________ explicitly allows the Internet Connection Firewall (ICF) to accept all incoming packets to a particular port.

A) IP masquerading
B) port mapping
C) port filtering
D) flow tabling

Question 78

________ is not a feature of Windows XP's security system.

A) Encrypting File System (EFS)
B) Determining whether applications possess a trusted certificate or comes from a trusted Internet Zone
C) Capabilities
D) Installing security patches with Automatic Update