2. Managing Windows Flashcards

1
Q

Purpose of Device Manager (devmgmt.msc)?

A

Manage installed hardware properties

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Where can you change config. settings, update drivers, & remove/disable devices?

A

Device Manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are common causes for a yellow exclamation mark in device manager?

A

Driver issues.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What to check if a device fails to connect to the OS?

A

Check if it (or the installed driver) is compatible with the OS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the first step to manually update or troubleshoot a device?

A

Find device in Device Manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the Safely Remove Hardware icon used for?

A

To safely stop or eject a device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the procedure to remove a driver before unplugging a device?

A

Uninstall device in Device Manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does disabling a device in Device Manager do?

A

Makes it inaccessible to users

Usually used if it is not working with the current driver and you want to make it inaccessible to users while you find a replacement.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What disk subsystem stores the OS, software, & user data?

The disk subsystem consists of storage devices, interfaces, file systems, and OS mechanisms for managing data storage and access.

A

Primary disk subsystem

Ensuring reliability and performance of the disk subsystem is critical for management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a ‘volume’?

A

Logical storage unit for the OS

A volume can have a 1:1 mapping with a partition or be created using RAID.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How does Windows refer to a mapped storage unit?

A

Drive

‘Drive’ can also refer to a physical hardware storage device.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the role of Disk 0?

A

To hold the OS

This disk will have at least three volumes: system, boot, and recovery.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

3 volumes that Disk 0 has?

A
  • System
  • Boot
  • Recovery
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What files does the system volume contain?

The system volume is stored in Disk 0

A

OS files

It is usually allocated the drive letter C:.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What files does the boot volume contain?

The boot volume is stored in disk 0

A

Boot files

Files used to boot the OS

Typically utilizes an extensible firmware interface (EFI) and is not assigned a drive letter.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What can unformatted drives be initilalized to?

A

MBR or GPT

MBR & GPT refer to the way the partition info is stored on the disk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What file system is typically used for new partitions in Windows?

A

NTFS

FAT32 may be used for smaller, removable drives.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is one advantage of using smaller clusters?

Clusters are the smallest units of storage on a disk that the OS can manage

A

Better use of disk capacity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What must be the format of the boot partition during setup?

The boot volume is stored in disk 0

A

NTFS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What must be the format of the system partition during setup?

The system volume is stored in disk 0

A

FAT32.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Can you format/delete system/boot partitions?

The system & boot volumes are stored in disk 0

A

No.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What can existing partitions do if there is unpartitioned space available?

A

Expanded or removed/shrunk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the purpose of dynamic disks?

A

To create dynamic volumes.

Dynamic volumes allows to combine multiple drives into a single virtual volume. This setups can also enable software RAID

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What feature has deprecated the dynamic disks feature?

A

Storage Spaces.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What does defragmentation do on an HDD?

A

Rewrites file data into contiguous clusters

Contiguous clusters are neighboring sections of storage on a hard drive where file data is stored. This reduces the time the controller takes to seek over the disk to read a file.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

How does data storage differ between HDDs and SSDs?

A

HDDs use contiguous clusters; SSDs use OS-independent blocks

Those blocks aren’t directly managed by the OS

The drive controller manages block usage according to wear-leveling routines.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is the main purpose of the optimizer tool for SSDs?

A

To run a TRIM operation

TRIM identifies deletable data and tags corresponding blocks as writable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What does the TRIM operation do on an SSD?

A

Tags deletable data as writable

This helps in managing the SSD’s storage efficiently.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

When does the optimizer defragment an SSD?

A

If it holds the OS & Volume Shadow Copy is enabled

This allows for some level of optimization in SSDs. Volume Shadow Copy is a Windows feature that creates backup copies or snapshots of files or volumes, even when they are in use.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

3 types of files the Disk Clean-up tool identifies for deletion?

A
  • Files in Recycle Bin
  • Temporary files
  • Caches
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What data can be reclaimed when using the Clean up system files option?

Via the Disk Clean-up tool

A

Cache Data

Like Windows Update and Defender

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

2 scheduling options for tasks in Task Scheduler?

A
  • Run once at a future date or time
  • Run on a recurring schedule

tasks can also be run based on a trigger (an event)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

How can tasks be organized in Task Scheduler?

A

Via folders

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What happens if a user account lacks permissions in Task Scheduler?

A

Task won’t run

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Purpose of the Local Users and Groups console (lusrmgr.msc)?

A

Manage user accounts & reset account passwords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What are security groups in the Local Users and Groups console (lusrmgr.msc) used for?

A

Group user accounts that need similar permissions

i.e. the right to edit files in a shared folder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

3 examples of default security groups?

A
  • Administrators
  • Users
  • Guests

These groups implement the account types that can be selected via the settings interface.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is a digital certificate?

A

Proof of a subject’s identity

the subject can be something like a user, computer, service, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Who guarantees the validity of each digital certificate?

A

The certification authority (CA).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What tool is used to manage certificates on a Windows system?

A

Certificate Manager console (certmgr.msc).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What is stored in the Personal folder of Certificate Manager?

A

Certificates issued to the user account.

Theyr’e used for authenticating to a network, encrypting data, & adding a signature to a document/message

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What does the Trusted Root Certification Authorities folder contain?

this is found in Certificate Manager

A

Certificates from trusted issuers

3 types of CAs included in here is Microsoft’s CA root, Local enterprise CAs, & Third-party CAs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Purpose of trusted root certificates?

A

Validate certificates issued by their CAs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What certificates does certmgr.msc and certlm.msc manage?

A

certmgr.msc: User certificates
certlm.msc: Computer certificates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What risk does a rogue CA certificate pose?

A

Could let a website impersonate a legit service

This can trick the user into revealing a password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What may be necessary if a certificate is compromised?

A

Remove it via Certificate Manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

How can vendors enhance Group Policy Editor for their software?

A

By creating templates to configure software with policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Why is Group Policy more efficient on networks with many computers?

A

Imposes settings without manual configuration

All machines are configured at once

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What does the HKEY_LOCAL_MACHINE (HKLM) database govern?

This is one of the Windows registry’s root keys

Root keys are the top-level containers in the Windows registry that store all configuration settings for the operating system and applications.

A

System-wide settings

HKLM is crucial for system configurations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What types of settings does the HKEY_USERS database include?

This is one of the Windows registry’s root keys

Root keys are the top-level containers in the Windows registry that store all configuration settings for the operating system and applications.

A

User Settings (They apply to individual user profiles)

This includes desktop personalization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What is the HKEY_CURRENT_USER (HKCU) database?

This is one of the Windows registry’s root keys

Root keys are the top-level containers in the Windows registry that store all configuration settings for the operating system and applications.

A

A subset of HKEY_USERS with settings for the logged in user

HKCU reflects user-specific configurations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Where are most registry hive files stored?

The Windows registry database is stored in binary files called hives

A

C:\Windows\System32\Config folder

User profile hives are stored in the user’s profile folder.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Purpose of the .LOG file in a registry hive?

The Windows registry database is stored in binary files called hives

A

Contains a transaction log

It helps in tracking changes made to the registry.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What is a .SAV file in a registry hive?

The Windows registry database is stored in binary files called hives

A

Snapshot of the key after setup

This file aids in restoring settings if needed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What is the filename for each user profile hive?

The Windows registry database is stored in binary files called hives

A

NTUSER.DAT

This file stores user-specific registry settings.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

How can you copy portions of the registry database?

A

Select File > Export Registry File

The file is saved in a registry-compatible format

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

How can the exported registry file be used on another computer?

A

Merged into the other PC’s registry by double-clicking the file or calling it from a script

When you export a registry file, you’re saving the settings or keys from the Windows registry into a file (usually with a .reg extension). This file can then be transferred to another computer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Device Manager, Disk Management, Group Policy Editor, & Certificate Managers are examples of ___.

A

MMC snap-ins

an MMC is a container for one or more snap-ins

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What does the mmc command allow you to do?

the command is run via Run

A

Customize MMC by adding chosen snap-ins

MMC stands for Microsoft Management Console.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What file extension is used for saving a custom MMC console?

A

.MSC

This file can be saved to the Administrative Tools folder.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What can a custom MMC console manage?

A

Personal and computer certificates on the local host

This enhances the ability to administer certificates effectively.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Can most MMC snap-ins be used for remote management?

A

Yes

Most snap-ins can manage either the local computer or a remote computer on the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Purpose of the System Information (msinfo32.exe) tool?

A

Report the system’s hardware & software components

i.e. system resources, firmware & OS versions, driver file locations, environemtn variables, network status, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

What type of events does the System log in the Windows Logs folder contain?

This is located in Event Viewer

A

Events that affect the core OS

i.e. service load failures, hardware conflicts, driver load failures,

This log is essential for diagnosing system-level problems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

3 things recorded in the Application log in the Windows Logs folder contain?

This is located in Event Viewer

A
  • Non-core processes
  • Utilities
  • Third-party apps

App installers typically write events to this log.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

What does the Security log in the Windows Logs folder hold?

This is located in Event Viewer

A

Audit data for the system.

This log is important for security monitoring and compliance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

What events does the Setup log in the Windows Logs folder record?

This is located in Event Viewer

A

Events during installation.

Useful for troubleshooting installation issues.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

What is the default maximum size for each log file in Windows Logs?

This is located in Event Viewer

A

About 20 MB.

This size can be adjusted in the log properties.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

3 options available for log file management?

A
  • Overwrite
  • Do not overwrite
  • Archive

Archiving closes the current file and starts a new one.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

True or False: It is important to monitor archive logs to prevent them from growing very large.

A

True

Unmonitored archive logs can consume significant disk space.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Where can additional logs be found for troubleshooting in Windows?

A

Under the Applications and Services Logs node.

These logs are useful for investigating specific Windows features or third-party applications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

What tool provides more in-depth monitoring than Task Manager?

A

Resource Monitor (resmon.exe)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

Purpose of Windows Performance Monitor (perfmon.msc)?

A

Show real-time resource charts & log data for analysis

It helps in identifying system bottlenecks and performance issues.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

3 potential causes of an app freezing?

A
  • Slow processor
  • Slow hard disk
  • Faulty/congested network link

Each of these factors can delay requests and affect performance.

75
Q

What are Data Collector Sets in Performance Monitor (perfmon.msc)?

A

Log files

They’re created to record info for later viewing

They help generate a library of performance measurements over time (used for long-term view of system performance)

76
Q

What are the two types of logs in Performance Monitor (perfmon.msc)?

A

Counter logs and trace logs

Each type serves different monitoring purposes.

77
Q

What do counter logs collect in Performance Monitor (perfmon.msc)?

A

Resource statistics

Resources like memory, disk, & processor

Used to determine system health and performance.

78
Q

What does trace logs in Performance Monitor (perfmon.msc) log?

A

Resource behavior

They log data that would otherwise be inaccessible.

79
Q

How can saved log files be utilized in Performance Monitor?

A

Used for analysis or exported to other programs

80
Q

(DELETE) What is the purpose of configuring a counter log in Performance Monitor?

A

To select what to monitor in the report.

81
Q

What are the objects collected in Performance Monitor?

In Performance Monitor, an object is a group of related counters, and a counter measures a specific system performance metric.

A

Memory and disk.

82
Q

What do objects contain in Performance Monitor?

A

Counters (Performance statistics)

An example of a performance counter is Average Queue Length

counters are metrics used to measure specific aspects of system performance

83
Q

What does the Processor % Processor Time counter indicate?

Processor is the object; % Processor Time is the counter

In Performance Monitor, an object is a group of related counters, and a counter measures a specific system performance metric.

A

CPU utilization

The percentage of time the processor runs a non-idle thread

84
Q

What indicates a potential processor bottleneck in Performance Monitor?

A

If % Processor Time is over 85% for a sustained period.

a counter measures a specific system performance metric

85
Q

What does the Processor % Privileged Time counter represent?

Processor is the object; % Privileged Time is the counter

In Performance Monitor, an object is a group of related counters, and a counter measures a specific system performance metric.

A

System CPU usage

Percentage of time spent on system processes.

86
Q

What does the Processor % User Time counter represent?

Processor is the object; % User Time is the counter

In Performance Monitor, an object is a group of related counters, and a counter measures a specific system performance metric.

A

User CPU usage

Percentage of time spent on apps

87
Q

What does the Physical Disk % Disk Time counter measure?

Physical Disk is the object; % Disk Time is the counter

In Performance Monitor, an object is a group of related counters, and a counter measures a specific system performance metric.

A

Disk utilization

Percentage of time the disk is busy with read/write requests

88
Q

What indicates a disk problem when monitoring % Disk Time?

a counter measures a specific system performance metric

A

If average is over 85% for a sustained period.

89
Q

(DELETE) What does the Average Disk Queue Length counter represent?

a counter measures a specific system performance metric

A

The number of pending disk requests during data collection

90
Q

What should the Available Bytes counter not fall below?

a counter measures a specific system performance metric

A

10% of total system RAM.

91
Q

What does a continuous fall in Available Bytes indicate?

a counter measures a specific system performance metric

A

Memory leak.

92
Q

What does the Pages/sec counter measure?

a counter measures a specific system performance metric

A

Page file I/O for hard faults

Number of pages read/written to disk for hard page faults

Hard page faults occur when data needed by a program is not in RAM and must be retrieved from the disk (paging file).

93
Q

What is the threshold for excessive paging indicated by Pages/sec counter?

a counter measures a specific system performance metric

A

Averaging above about 50.

94
Q

[DELETE] What does the Paging File % Usage counter represent?

Paging File is the object; % Usage is the counter

In Performance Monitor, an object is a group of related counters, and a counter measures a specific system performance metric.

A

Percentage of pagefile instance in use

A pagefile instance refers to a specific paging file on a disk. The paging file is a portion of disk space used as virtual memory when the physical RAM is full

95
Q

If your paging file is 1000 MB and % Usage averages 50%, what does that imply?

A

You might benefit from adding 500 MB of memory.

If the paging file is using 50% of its capacity, adding more RAM (500MB in this case) would reduce reliance on the slower paging file, improving system performance.

96
Q

What can low system memory indicate about disk performance?

A

Disk may slow from high paging

97
Q

What can you adjust in the System Configuration Utility (msconfig.exe)?

A

Adjust boot settings & startup files

It is often used for diagnostic purposes rather than permanent configuration changes.

98
Q

What does the Boot tab in System Configuration Utility allow you to configure?

A

Basic settings in the Boot Configuration Data (BCD) store

Including changing the default OS & adding boot options

Boot options like Safe Mode can be configured here. The BCD store is a Windows database that holds boot configuration settings, including OS details, boot options, and recovery settings, used by the Boot Manager to start the system.

99
Q

How can you add boot paths in the Boot tab (System Configuration Utility)?

Boot paths are the file system locations and configurations used by an OS to locate and load essential files during the startup process

A

via bcdedit command.

This is run via cmd prompt; cmd prompt needs to be run as admin

100
Q

What should you check if a system keeps using safe boot or boots to a command prompt?

A

Verify System Configuration settings to ensure options aren’t permanent.

101
Q

What does the Services tab (System Configuration Utility) allow to do?

A

Choose which services run at startup

It alos shows the date a service was disabled

102
Q

What does the Tools tab in the System Configuration Utility contain?

A

Shortcuts to admin utilities

i.e. System Information, Registry Editor, & Performance Monitor

103
Q

True or False: The boot log file created by msconfig is shown in Event Viewer.

104
Q

What do frequent page faults indicate during performance monitoring

A

The system relies heavily on the pagefile & may need more RAM

105
Q

is it a problem if the CPU usage often jumps to 100% & then falls back?

(in task manager)

A

No

CPU spikes are normal, but sustained 80-90% usage may need a faster CPU or signal a faulty app

106
Q

What does it mean if a program runs at startup, but is not in the Startup folder?

A

Program has added a registry entry to run at startup

Can be disabled via Task Manager

107
Q

What tool is this?

A

System Information tool

This tool procudes a hardware & software inventory report

108
Q

What is the command to open the Sytem Information tool?

A

msinfo32.exe

This tool procudes a hardware & software inventory report

109
Q

2 Ways to access Task Manager?

A
  • Ctrl+Alt+Del
  • Ctrl+Shift+Esc
110
Q

How to run a command that requires elevated privileges?

A

Open command prompt as administrator.

You can do this by right-clicking command prompt & selecting Run as administrator

111
Q

What is the default folder when the command prompt is run as administrator?

A

C:\Windows\System32

112
Q

What command can be used to clear the command prompt screen?

113
Q

What should you do if an argument includes a space?

A

Enter it within quotes.

i.e. cd "C:\Program Files\My Application"

114
Q

What command is used to exit an interactive program?

interactive programs like telnet, etc.

A

exit or quit

115
Q

what command lists available commands in the command prompt?

116
Q

2 ways to list the syntax & switches for a command?

A
  • help [command]
  • [command] /?

i.e. help cd & cd /?

117
Q

True or False: You can continue using the same command prompt window if you need to run a command that requires elevation.

118
Q

What is the effect of using the forward slash escape character in command syntax?

i.e. dir /s

A

Precedes switches.

119
Q

What command is used to list the files and subdirectories?

A

dir

The dir command can be used to list files from the working drive or a specified path.

120
Q

What switch is used with the dir command to present files in a particular order?

A

/o:x

i.e. dir /o:n

The x can be n (name), s (size), e (extension), or d (date).

121
Q

Which switch is used to set the date field for the dir command?

A

/t:x

i.e. dir /t:x

The x can be c (created on), a (last access), or w (last modified).

122
Q

What does the /a:x switch do in the dir command?

A

Displays files with the attribute indicated by x

The attributes can be r (Read-only), h (hidden), s (system), or a (archive).

123
Q

What wildcard character represents a single unspecified character?

A

?

For example, dir ????????.log displays all .log files with eight characters in the file name.

124
Q

How do you change to a specific directory using the cd command?

A

Enter the full path

Example: cd C:\Users\David

125
Q

What command would you use to move up to the parent directory?

A

cd ..

This command moves you one level up in the directory structure.

126
Q

How do you change to the root directory of the drive?

A

cd \

This command takes you to the root directory.

127
Q

What command is used to change the working drive?

A

Enter the drive letter followed by a colon

Example: D: changes to the D drive.

128
Q

What is the syntax for the move and copy commands?

A

[command] [Source] [Destination]

i.e. (move file.txt C:\Documents) (`copy file.txt C:\Backup)

‘Source’ is the drive name, path, and name of the files, while ‘Destination’ is the drive name and path of the new location.

129
Q

What utility allows you to copy multiple directories while retaining the directory structure?

A

xcopy

i.e. xcopy C:\SourceFolder D:\DestinationFolder /E /I

The syntax for xcopy is: xcopy Source [Destination] [Switches].

130
Q

What is the primary advantage of using robocopy over xcopy?

A

robocopy works better with long file names and NTFS attributes

Microsoft now recommends using robocopy rather than xcopy.

131
Q

What is the command to create a new directory?

A

md or mkdir

Example: To create a directory called Data, type md Data.

132
Q

Which command is used to delete an empty directory?

A

rd [Directory] or rmdir [Directory]

Use /s switch to remove non-empty directories.

133
Q

What is the purpose of the /s switch in the rmdir command?

i.e. rmdir C:\TestFolder /s

A

To remove files and subdirectories from a directory

Also, the /q switch can be used to suppress confirmation messages.

134
Q

What characters can’t folders/files contain?

A
  • \ /
  • :
  • *
  • ?
  • "
  • < >
  • |

These characters are not allowed in folder and file names.

135
Q

What switch can be used to move files using robocopy?

A

/mov

i.e. robocopy C:\SourceFolder D:\DestinationFolder /mov

Despite its name, robocopy can also move files.

136
Q

What does the xcopy command allow you to do?

i.e. xcopy C:\SourceFolder D:\DestinationFolder /e /i

A

Copy the contents of more than one directory at a time

It retains the directory structure.

137
Q

True or False: The robocopy command is primarily used for copying files only.

A

False

robocopy can also move files using the /mov switch.

138
Q

How to inspect disks using diskpart?

A

Run the diskpart utility and enter select disk 0

139
Q

What command displays configuration info for a selected disk in diskpart?

A

detail disk

140
Q

What does diskpart report if the hard disk has no partitions?

A

The partition table may have become corrupted

141
Q

What command do you use to select a partition in diskpart?

A

select partition 0 or select volume 0.

142
Q

What command is used to view information about a selected partition or volume in diskpart?

A

detail partition or detail volume

143
Q

3 commands you can use after selecting a partition or volume in diskpart?

A
  • assign
  • delete
  • extend

assign changes the drive letter, delete destroyes the volume, extend extends the size

144
Q

What does the format command do?

i.e. format D: /fs:NTFS

A

Writes a new file system to a drive, deleting existing data.

145
Q

What is the basic syntax of the format command?

A

format X: /fs:SYS

X is the drive letter; SYS is the file system

i.e. format D: /fs:NTFS

146
Q

What does the /q switch do in the format command?

i.e. format D: /fs:NTFS /q

A

Skips the scan for bad sectors.

This makes the process faster

Sectors are the smallest physical storage units on a disk

147
Q

What happens during both standard and quick format operations?

A

Removes references to existing files in the volume boot record.

During a format, the system removes the file references in the file system (like NTFS or FAT32), which are pointers to where data is stored on the disk. The data itself isn’t immediately erased, but the space is marked as available for reuse.

148
Q

Can data be recovered from a formatted disk?

A

Yes, using third-party tools.

149
Q

What is a secure format utility?

A

Tool that overwrites sectors with a zero value, preventing data recovery

A sector is the smallest data unit on a disk, where written data is stored. Secure format utilities like the Cipher command (Windows) and third-party tools overwrite data to prevent recovery.

150
Q

What does the chkdsk command do?

A

Scans the file system and/or disk sectors for faults and attempts repairs.

A sector is the smallest data unit on a disk, where written data is stored.

151
Q

What is the command to run chkdsk in read-only mode?

A

chkdsk X:.

chkdsk C:

152
Q

What does the chkdsk X: /f command do?

chkdsk C: /f

A

Attempts to fix file system errors.

153
Q

What does the chkdsk X: /r command do?

chkdsk C: /r

A

Fixes file system errors and attempts recovery of bad sectors.

A sector is the smallest data unit on a disk, where written data is stored.

154
Q

What happens if chkdsk detects recoverable data?

A

It is copied to the root directory as filennnn.chk files.

155
Q

True or False: Check Disk tool can fix open files.

(meaning files in use)

156
Q

What is recommended before running chkdsk /f or chkdsk /r?

A

Run a read-only scan first.

Which is done via chkdsk C:

157
Q

What is the command to safely halt the system?

A

shutdown /s

This command closes all open programs and services before powering off the computer.

158
Q

What does the command shutdown /h do?

A

Saves current session to disk before powering off PC

This is known as hibernation.

159
Q

What is the purpose of the shutdown /l command?

A

Logs off the user account while leaving the computer running

This closes all programs and services started under the user account.

160
Q

What does shutdown /r do?

A

Restarts PC without powering it down

This is also referred to as a soft reset.

161
Q

What does the shutdown /s /t nn command do?

“nn” would be replaced with a number

A

Specifies a timer before shutdown starts

The default delay is 30 seconds if no number is provided

162
Q

What command aborts a shutdown in progress?

A

shutdown /a

This command must be used quickly enough to be effective.

163
Q

What is the function of the System File Checker (sfc)?

A

Verifies & restores corrupt system files from cache

It provides a manual interface for this process.

164
Q

What does the command sfc /scannow do?

A

Runs a scan immediately

This checks for corrupt system files right away.

165
Q

What does sfc /scanonce do?

A

Schedules a scan for the next computer restart

This allows for a one-time scan at the next boot.

166
Q

What does sfc /scanboot do?

A

Schedules a scan to run at each PC boot

This ensures continuous monitoring of system files.

167
Q

Where are system files maintained in Windows?

A

WINSxS system folder

This folder is version-controlled and can consume significant disk space.

168
Q

What does the winver command report?

A

Version information of Windows

This is often needed for support purposes.

169
Q

What does the Version refer to in Windows version information?

Examples include 1607 (July 2016) or 21H1 (first half of 2021).

A

A feature update via a year/month code

170
Q

What is the OS Build in Windows version information?

A

Code showing brand & update status

The rev number can be used to look up changes and known issues.

171
Q

Which is more informative for Windows version details, winver or the About settings page?

A

The About settings page

It lists edition and license information in addition to version details.

172
Q

How do you perform a scan to idetify file system errors in read-only mode?

A

run chkdsk in command prompt

173
Q

Which Windows command is ideal for scripting file backups?

Scripting file backups means using a command-line tool or script to automate the process of copying or archiving files for backup purposes

174
Q

What console monitors live CPU, memory, disk, and network usage?

A. certmgr.msc
B. taskschd.msc
C. resmon.exe
D. gpedit.msc

A

C. resmon.exe

175
Q

An incident handler is reviewing a possible cryptomining infection on one of the corporate servers. What should the handler use first to investigate?

A. eventvwr.msc
B. taskmgr.exe
C. regedit.exe
D. taskschd.msc

A

B. taskmgr.exe

176
Q

Which command helps investigate malware replacing system files?

A. sfc
B. chkdsk
C. winver
D. shutdown

A

A. sfc

Windows Resource Protection safeguards system files and registry keys. The System File Checker (sfc) verifies and restores corrupt system files from cache.

177
Q

Which option helps improve system security after patching is improved?

A. msinfo32.exe
B. resmon.exe
C. services.msc
D. dfrgui.exe

A

C. services.msc

From Task Manager, the Open Services button links to the Services (services.msc) console. This can disable nonessential services to improve performance or security.

178
Q

How can a user change the default OS in a dual-boot setup?

A. msconfig.exe
B. resmon.exe
C. taskschd.msc
D. gpedit.msc

A

A. msconfig.exe

The System Configuration Utility (msconfig.exe) modifies boot settings, like changing the default OS, adding boot options, and setting the timeout value.

179
Q

Which cmmand should a Windows server use to transfer logs to a central security platform via a script?

A. xcopy Source [Destination] [Switches]
B. md Source [Destination] [Switches]
C. robocopy Source [Destination] [Switches]
D. rmdir Source [Destination] [Switches]

A

C. robocopy Source [Destination] [Switches]

Robocopy is a file copy utility recommended by Microsoft over xcopy, as it handles long file names and NTFS attributes better.

180
Q

What tool should a server administrator use for resource performance graphs and statistics?

A. taskmgr.exe
B. services.msc
C. msconfig.exe
D. resmon.exe

A

D. resmon.exe

Resource Monitor (resmon.exe) shows an enhanced version of the type of snapshot monitoring provided by the Task Manager.

181
Q

Which command should a user run to diagnose issues with large files?

A. format
B. diskpart
C. chkdsk
D. winver

182
Q

What should a technician use to optimize HDD input/output operations performance?

A. devmgmt.msc
B. dfrgui.exe
C. resmon.exe
D. secpol.msc

A

B. dfrgui.exe

The Defragment and Optimize Drives tool (dfrgui.exe) runs various operations to speed up the performance of hard disk drives (HDDs).

183
Q

What is the best way for a security admin. to push configuration changes to users?

A. regedit.exe
B. services.msc
C. lusrmgr.msc
D. gpedit.msc

A

D. gpedit.msc

The Group Policy Editor (gpedit.msc) provides a more robust means of configuring many of these Windows settings than editing the registry directly.

184
Q

Where should a user check for changes after experiencing a BSoD on startup?

A. WSL
B. devmgmt.msc
C. taskschd.msc
D. services.msc

A

B. devmgmt.msc

Most BSoDs, especially during startup, are caused by faulty hardware or drivers. Device Manager (devmgmt.msc) lets users view and edit hardware properties.