Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Windoe > 03 > Flashcards

03 Flashcards

1
Q

___________________ Volatile hive created at boot that contains hardware information provided by the firmware (HKLM sub-key)

A

HKLM/Hardware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

_____________________ contains boot configuration data, used with 6.* and 10.* architectures (HKLM sub-key)

A

HKLM\BCD00000000000

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

_____________ contains local account information as well as password values (HKLM sub-key)

A

HKLM/SAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

____________ contains cached logons and local security policy (HKLM sub-key)

A

HKLM/Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

__________ Contains a collection of sub-keys for various installed components and programs (HKLM-subkey)

A

HKLM\SOFTWARE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

__________ contains control sets from which HKCC is derived

A

HKLM/System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

_____________ contains information about currently installed hardware and contains several sub-keys with information that is generated during boot-up

A

HARDWARE Sub-Key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

____________ sub-key, contains all local account information

A

SAM sub-key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

___________ sub-key contains information about cached logons, policy, special accounts, and registry transaction (RXACT PACKAGE)

A

Security sub-key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

___________ sub-key contains logon information for the last ten people

A

cache sub-key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

__________ sub-key contains a collection of sub-keys for various installed components and applications

A

Software sub-key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Important entries in the software sub-key

_______ defines current installation of windows

________list of executables that run on system start-up

________programs are deleted from key once executed (e.g., software updates)

________ similar to run but for services, (May not always be present

A

currentversion

currentversion\run

currentversion\runonce

currentversion\runservices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Can the software sub-key be used to determine if the machine is a VM?

A

yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

________ sub-key contains definitions, control sets, and information about removable media

A

System sub-key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

The select key contains
_______
_______
_______

A

Current
Failed
LastKnownGood

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the sub-keys for the control sets under System sub-key?

A

Control
Enum
Mounted Devices
Services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the entries for control under controlsets?

_____________Local security authority. Validates security for local users.

____________ manages user’s session and basic start-up

___________System determines which edition is booted by querying registry values under HKLM\SYSTEM\CurrentControlSet\Control\Productoptions

A

LSA

Session Manager

Product options

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the entries for Enum under controlsets?

_________ Provides USB device information including a description and hardware identification. Useful for tracking usage of a particular USB-connected device across multiple machines.

_________ contains device driver information

A

USB/USBSTOR

SCSI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

_________ shows drives available to system (controlsets)

A

Mounted devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

__________ contains information about services and drivers available to the system (controlsets)

A

Services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Major sub-keys of HKCU include:

_________ user settings and defaults are stored here, including color schemes, appearance and accessibility options to name a few

_________ contains current session information

_____ contains installed software information

A

Control Panel

Session Information

Software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

HKCC is used to establish the current hardware configuration profile what are its two sub-keys?

_________ has a Microsoft sub-key, may have other application sub-keys

_________ contains objects that temporarily modify current control set

A

Software

System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the Registry data types?

________ Raw binary data; hardware component information stored as binary data

________ Most common value type consisting of 32-bit numbers expressed in decimal or hexadecimal

_________ Fixed length text string

_________ A Variable-length text string allowing use of environmental variables

_________ contains lists or multiple text string values

A

REG_BINARY

REG_DWORD

REG_SZ

REG_EXPAND_SZ

REG_MULTI_SZ

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What command is used for editing the registry>

A

reg.exe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

___________ add an object or value to registry . registry path is root key or hive. Data type by default is REG_SZ unless another type is specified

example? : C:

A

REG ADD

reg add registrypath [data type] [\Machine]

26
Q

_______ Displays registry object value command?

example? C:

A

Reg query

reg query keyname [/v valuename or /ve] [\Machine]

27
Q

______ removes an object, it deletes a value forma remote machine

example?

A

reg delete

C:>reg delete registrypath [//Machine] NewPath [\Machine]

28
Q

________ changes path or moves to another machine

example?

A

reg copy

C:>reg copy OldPath [//Machine] NewPath [\Machine]

29
Q

_______ Loads a hive file

example?

A

reg load

C:>reg load registrypath [filename]

30
Q

________ Code written for adaptability and change to meet ever-changing market demands. (windows architecture)

A

Extensibility

31
Q

_________ Support multiple hardware architectures and must be adaptable for innovations and new technologies. (windows architecture)

A

Portability

32
Q

_________ Protect itself from internal malfunctions and faulty applications. (windows architecture)

A

Reliability

33
Q

__________ Meet government and industry requirements for system security and protections against external tampering. (windows architecture)

A

Security

34
Q

________ User interface and API must provide extended legacy support and integration with other systems, such as UNIX. (windows architecture)

A

Compatibility

35
Q

________ Fast and responsive while meeting the constraints of the other design goals. (windows architecture)

A

Performance

36
Q

The ______ runs in the most p[riviliged ring of the CPU (RIng ___) known as __________

A

Kernel
0
Kernel Mode

37
Q

The OS Interface and user applications execute in the least privliged ring of the CPU (Ring __) known as __________

A

3 user mode

38
Q

-
-

A

Access too all system memory and entire CPU instruction set

Kernel mode OS and device driver code share address space

privileged to perform almost any action

closest to hardware

39
Q

-
-
-

A

Greatly limited in permission and authority

OS interface and system software

User Applications

Closest to User

40
Q

____________ determine the environment a user operates in, how that user gets authenticated, how the user accesses resources, etc

A

Processes

41
Q

The __________ process is loaded by the kernel during the boot process and is the first user mode process to start,

WHAT LOADS THIS?

A

Session Manager

NTOSKRNL.exe

42
Q

WHAT LOADS THE SUBSYSTEM?

What are the components of the windows subsystem?

________ THE subsystem process. Subsystem DLLs run in the context of this process
________ contains code that gives programs access to system functions

_______ contains basic functions, such as window management, user input , text, etc

________ part of the windows graphic device interface that enables programs and applications to use graphics and formatted text on the video display and printer

_____ part of an advanced API services library supporting numerous APIs including security and registry calls

_____ itroduced with 6.1 architectures, it contains a
combination of functions and code originally contained
in kernel32 and advapi32 libraries

_____ Subsystem kernel mode device driver that performs the following

Controls window displays; manages screen output; collects input from
keyboard, mouse, and other devices; and passes user messages to
applications.
 Serves as the GDI for line, text, and graphics manipulation.

A

SMSS.EXE

csrss.exe
kernal 32.dll
user32.dll
gdi32.dll
advapi32.dll
kernealbase.dll
win32k.sys

43
Q

Of the product type registry values, WinNT, LanmanNT, ServerNT

What do each represent?

A

Windows workstation OS
Windows server Domain COntroller OS
Windows Server OS

44
Q

What process initializes file swap?

What process loads this?

A

pagefile.sys

SMSS.exe

45
Q

What process starts windows initialization process?

What loads before this process?

A

wininit.exe

CSRSS.exe

46
Q

What process is loaded by the kernel during the boot process and is the first user mode process to start?

A

smss.exe session manager

47
Q

What process acts as a message handling intermediary between the console and crss.exe to protect against certain exploits?

A

conhost.exe

48
Q

What process is after csrss.exe and what are its sub processes?

what are each responsible for?

A

winint.exe
services.exe (service control manager) managing services
Lsass.exe (authentication for user credentials)

49
Q

What process follows wininit.exe? Can there be multiples of these? What does it do?

A

SMSS.EXE(1) yes for every user logged in, duplicating CSRSS.exe and all its dependencies

50
Q

SMSS.exe(1) what does this new session initialize following CSRSS.exe(1)? What does it do?

What are the three processes it initiates?

A

winlogon.exe -handles interactive user logon and logoffs

Logonui.exe
userint.exe
explorer.exe

51
Q

What process is the king of the whole boot sequence?

A

NTOSKRNL.exe

52
Q

What is the order of the boot processes?

SMSS.EXE (1)

Services.exe

LSAASS.exe

Winit.exe

CSRSS.exe (0)

WinLogon.exe(1)

LogonUI.exe(1)

Userinit.exe(1)

SMSS.EXE(0)

CSRSS.exe(1)

pagefile.sys

explorer.exe

NTOSKRNL.exe

kernal32.dll
user32.dll
gdi32.dll
advapi32.dll
kernalbase.dll
win32k.sys
conhost.exe

A

NTOSKRNL.exe

SMSS.EXE
pagefile.sys
win32k.sys

Csrss.exe(0)
kernal32.dll
user32.dll
gdi32.dll
advapi32.dll
kernalbase.dll
win32k.sys
conhost.exe

WIniit.exe (0)
Lssas.exe (0)
services.exe (0)

Smss.exe(1)
Csrss.exe(all dependency’s)
winlogon.exe(1)
logonui.exe
userinit.exe
explorer.exe

53
Q

What process is responsible for the whole desktop?

A

explorer.exe

54
Q

______ acts as the emulator for allowing 32-bit applications to run seamlessly on a windows 64.bit OS

A

Wow64

55
Q

_______ core interface tha translates between 32-bit and 64-bit calls

A

wow64.dll

56
Q

_______ provides architecture specific support and manages switching the CPU between 32-bit and 64-bit modes

A

wow64cpu.dll

57
Q

____ intercepts GUI system calls exported by win32.sys

A

wow64win.dll

58
Q

where are the built-in 64 bit images (cmd.exe) and DLL’s including wow64 DLLs located?

A

\Windows\System32

59
Q

Where are the 32 bit images and DLLs needed for redirection located?

A

\Windows\Syswow64

60
Q

The _____ contains internal support functions used by the subsystem DLLs and serves as the service call dispatch to the windows executive

A

ntd.dll Native API

Windoe (12 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions