2. Managing Windows Flashcards
1
Q
Purpose of Device Manager (devmgmt.msc)?
A
Manage installed hardware properties
2
Q
Where can you change config. settings, update drivers, & remove/disable devices?
A
Device Manager
3
Q
What are common causes for a yellow exclamation mark in device manager?
A
Driver issues.
4
Q
What to check if a device fails to connect to the OS?
A
Check if it (or the installed driver) is compatible with the OS
5
Q
What is the first step to manually update or troubleshoot a device?
A
Find device in Device Manager
6
Q
What is the Safely Remove Hardware icon used for?
A
To safely stop or eject a device
7
Q
What is the procedure to remove a driver before unplugging a device?
A
Uninstall device in Device Manager
8
Q
What does disabling a device in Device Manager do?
A
Makes it inaccessible to users
Usually used if it is not working with the current driver and you want to make it inaccessible to users while you find a replacement.
9
Q
What disk subsystem stores the OS, software, & user data?
The disk subsystem consists of storage devices, interfaces, file systems, and OS mechanisms for managing data storage and access.
A
Primary disk subsystem
Ensuring reliability and performance of the disk subsystem is critical for management.
10
Q
What is a ‘volume’?
A
Logical storage unit for the OS
A volume can have a 1:1 mapping with a partition or be created using RAID.
11
Q
How does Windows refer to a mapped storage unit?
A
Drive
‘Drive’ can also refer to a physical hardware storage device.
12
Q
What is the role of Disk 0?
A
To hold the OS
This disk will have at least three volumes: system, boot, and recovery.
13
Q
3 volumes that Disk 0 has?
A
- System
- Boot
- Recovery
14
Q
What files does the system volume contain?
The system volume is stored in Disk 0
A
OS files
It is usually allocated the drive letter C:.
15
Q
What files does the boot volume contain?
The boot volume is stored in disk 0
A
Boot files
Files used to boot the OS
Typically utilizes an extensible firmware interface (EFI) and is not assigned a drive letter.
16
Q
What can unformatted drives be initilalized to?
A
MBR or GPT
MBR & GPT refer to the way the partition info is stored on the disk.
17
Q
What file system is typically used for new partitions in Windows?
A
NTFS
FAT32 may be used for smaller, removable drives.
18
Q
What is one advantage of using smaller clusters?
Clusters are the smallest units of storage on a disk that the OS can manage
A
Better use of disk capacity.
19
Q
What must be the format of the boot partition during setup?
The boot volume is stored in disk 0
A
NTFS.
20
Q
What must be the format of the system partition during setup?
The system volume is stored in disk 0
A
FAT32.
21
Q
Can you format/delete system/boot partitions?
The system & boot volumes are stored in disk 0
A
No.
22
Q
What can existing partitions do if there is unpartitioned space available?
A
Expanded or removed/shrunk.
23
Q
What is the purpose of dynamic disks?
A
To create dynamic volumes.
Dynamic volumes allows to combine multiple drives into a single virtual volume. This setups can also enable software RAID
24
Q
What feature has deprecated the dynamic disks feature?
A
Storage Spaces.
25
What does defragmentation do on an HDD?
Rewrites file data into contiguous clusters
## Footnote
Contiguous clusters are neighboring sections of storage on a hard drive where file data is stored. This reduces the time the controller takes to seek over the disk to read a file.
26
How does data storage differ between HDDs and SSDs?
HDDs use contiguous clusters; SSDs use OS-independent blocks
| Those blocks aren't directly managed by the OS
## Footnote
The drive controller manages block usage according to wear-leveling routines.
27
What is the main purpose of the optimizer tool for SSDs?
To run a TRIM operation
## Footnote
TRIM identifies deletable data and tags corresponding blocks as writable.
28
What does the TRIM operation do on an SSD?
Tags deletable data as writable
## Footnote
This helps in managing the SSD's storage efficiently.
29
When does the optimizer defragment an SSD?
If it holds the OS & Volume Shadow Copy is enabled
## Footnote
This allows for some level of optimization in SSDs. Volume Shadow Copy is a Windows feature that creates backup copies or snapshots of files or volumes, even when they are in use.
30
3 types of files the Disk Clean-up tool identifies for deletion?
- Files in Recycle Bin
- Temporary files
- Caches
31
What data can be reclaimed when using the **Clean up system files** option?
| Via the Disk Clean-up tool
Cache Data
| Like Windows Update and Defender
32
2 scheduling options for tasks in Task Scheduler?
- Run once at a future date or time
- Run on a recurring schedule
| tasks can also be run based on a trigger (an event)
33
How can tasks be organized in Task Scheduler?
Via folders
34
What happens if a user account lacks permissions in Task Scheduler?
Task won't run
35
Purpose of the Local Users and Groups console (lusrmgr.msc)?
Manage user accounts & reset account passwords
36
What are security groups in the Local Users and Groups console (lusrmgr.msc) used for?
Group user accounts that need similar permissions
| i.e. the right to edit files in a shared folder
37
3 examples of default security groups?
- Administrators
- Users
- Guests
## Footnote
These groups implement the account types that can be selected via the settings interface.
38
What is a digital certificate?
Proof of a subject’s identity
| the subject can be something like a user, computer, service, etc.
39
Who guarantees the validity of each digital certificate?
The certification authority (CA).
40
What tool is used to manage certificates on a Windows system?
Certificate Manager console (certmgr.msc).
41
What is stored in the Personal folder of Certificate Manager?
Certificates issued to the user account.
## Footnote
Theyr'e used for authenticating to a network, encrypting data, & adding a signature to a document/message
42
What does the **Trusted Root Certification Authorities** folder contain?
| this is found in **Certificate Manager**
Certificates from trusted issuers
## Footnote
3 types of CAs included in here is Microsoft's CA root, Local enterprise CAs, & Third-party CAs
43
Purpose of trusted root certificates?
Validate certificates issued by their CAs
44
What certificates does **certmgr.msc** and **certlm.msc** manage?
**certmgr.msc**: User certificates
**certlm.msc**: Computer certificates
45
What risk does a rogue CA certificate pose?
Could let a website impersonate a legit service
| This can trick the user into revealing a password
46
What may be necessary if a certificate is compromised?
Remove it via Certificate Manager
47
How can vendors enhance Group Policy Editor for their software?
By creating templates to configure software with policies
48
Why is Group Policy more efficient on networks with many computers?
Imposes settings without manual configuration
| All machines are configured at once
49
What does the HKEY_LOCAL_MACHINE (HKLM) database govern?
| This is one of the Windows registry's root keys
## Footnote
Root keys are the top-level containers in the Windows registry that store all configuration settings for the operating system and applications.
System-wide settings
## Footnote
HKLM is crucial for system configurations.
50
What types of settings does the HKEY_USERS database include?
| This is one of the Windows registry's root keys
## Footnote
Root keys are the top-level containers in the Windows registry that store all configuration settings for the operating system and applications.
User Settings (They apply to individual user profiles)
## Footnote
This includes desktop personalization.
51
What is the HKEY_CURRENT_USER (HKCU) database?
| This is one of the Windows registry's root keys
## Footnote
Root keys are the top-level containers in the Windows registry that store all configuration settings for the operating system and applications.
A subset of HKEY_USERS with settings for the logged in user
## Footnote
HKCU reflects user-specific configurations.
52
Where are most registry hive files stored?
| The Windows registry database is stored in binary files called hives
C:\Windows\System32\Config folder
## Footnote
User profile hives are stored in the user's profile folder.
53
Purpose of the .LOG file in a registry hive?
| The Windows registry database is stored in binary files called hives
Contains a transaction log
## Footnote
It helps in tracking changes made to the registry.
54
What is a .SAV file in a registry hive?
| The Windows registry database is stored in binary files called hives
Snapshot of the key after setup
## Footnote
This file aids in restoring settings if needed.
55
What is the filename for each user profile hive?
| The Windows registry database is stored in binary files called hives
NTUSER.DAT
## Footnote
This file stores user-specific registry settings.
56
How can you copy portions of the registry database?
Select File > Export Registry File
## Footnote
The file is saved in a registry-compatible format
57
How can the exported registry file be used on another computer?
Merged into the other PC's registry by double-clicking the file or calling it from a script
## Footnote
When you export a registry file, you're saving the settings or keys from the Windows registry into a file (usually with a .reg extension). This file can then be transferred to another computer.
58
Device Manager, Disk Management, Group Policy Editor, & Certificate Managers are examples of ___.
MMC snap-ins
| an MMC is a container for one or more snap-ins
59
What does the *mmc* command allow you to do?
| the command is run via ***Run***
Customize MMC by adding chosen snap-ins
## Footnote
MMC stands for Microsoft Management Console.
60
What file extension is used for saving a custom MMC console?
.MSC
## Footnote
This file can be saved to the Administrative Tools folder.
61
What can a custom MMC console manage?
Personal and computer certificates on the local host
## Footnote
This enhances the ability to administer certificates effectively.
62
Can most MMC snap-ins be used for remote management?
Yes
## Footnote
Most snap-ins can manage either the local computer or a remote computer on the network.
63
Purpose of the System Information (msinfo32.exe) tool?
Report the system's hardware & software components
## Footnote
i.e. system resources, firmware & OS versions, driver file locations, environemtn variables, network status, etc.
64
What type of events does the **System log** in the Windows Logs folder contain?
| This is located in **Event Viewer**
Events that affect the core OS
| i.e. service load failures, hardware conflicts, driver load failures,
## Footnote
This log is essential for diagnosing system-level problems.
65
3 things recorded in the **Application log** in the Windows Logs folder contain?
| This is located in **Event Viewer**
- Non-core processes
- Utilities
- Third-party apps
## Footnote
App installers typically write events to this log.
66
What does the **Security log** in the Windows Logs folder hold?
| This is located in **Event Viewer**
Audit data for the system.
## Footnote
This log is important for security monitoring and compliance.
67
What events does the **Setup log** in the Windows Logs folder record?
| This is located in **Event Viewer**
Events during installation.
## Footnote
Useful for troubleshooting installation issues.
68
What is the default maximum size for each log file in Windows Logs?
| This is located in **Event Viewer**
About 20 MB.
## Footnote
This size can be adjusted in the log properties.
69
3 options available for log file management?
- Overwrite
- Do not overwrite
- Archive
## Footnote
Archiving closes the current file and starts a new one.
70
True or False: It is important to monitor archive logs to prevent them from growing very large.
True
## Footnote
Unmonitored archive logs can consume significant disk space.
71
Where can additional logs be found for troubleshooting in Windows?
Under the Applications and Services Logs node.
## Footnote
These logs are useful for investigating specific Windows features or third-party applications.
72
What tool provides more in-depth monitoring than Task Manager?
Resource Monitor (resmon.exe)
73
Purpose of Windows Performance Monitor (perfmon.msc)?
Show real-time resource charts & log data for analysis
## Footnote
It helps in identifying system bottlenecks and performance issues.
74
3 potential causes of an app freezing?
* Slow processor
* Slow hard disk
* Faulty/congested network link
## Footnote
Each of these factors can delay requests and affect performance.
75
What are **Data Collector Sets** in Performance Monitor (perfmon.msc)?
Log files
| They're created to record info for later viewing
## Footnote
They help generate a library of performance measurements over time (used for long-term view of system performance)
76
What are the two types of logs in Performance Monitor (perfmon.msc)?
Counter logs and trace logs
## Footnote
Each type serves different monitoring purposes.
77
What do counter logs collect in Performance Monitor (perfmon.msc)?
Resource statistics
| Resources like memory, disk, & processor
## Footnote
Used to determine system health and performance.
78
What does trace logs in Performance Monitor (perfmon.msc) log?
Resource behavior
## Footnote
They log data that would otherwise be inaccessible.
79
How can saved log files be utilized in Performance Monitor?
Used for analysis or exported to other programs
80
(DELETE) What is the purpose of configuring a counter log in Performance Monitor?
To select what to monitor in the report.
81
What are the objects collected in Performance Monitor?
## Footnote
In Performance Monitor, an object is a group of related counters, and a counter measures a specific system performance metric.
Memory and disk.
82
What do objects contain in Performance Monitor?
Counters (Performance statistics)
| An example of a performance counter is Average Queue Length
## Footnote
counters are metrics used to measure specific aspects of system performance
83
What does the **Processor % Processor Time** counter indicate?
| ***Processor*** is the object; **% Processor Time** is the counter
## Footnote
In Performance Monitor, an object is a group of related counters, and a counter measures a specific system performance metric.
CPU utilization
| The percentage of time the processor runs a non-idle thread
84
What indicates a potential processor bottleneck in Performance Monitor?
If **% Processor Time** is over 85% for a sustained period.
| a counter measures a specific system performance metric
85
What does the **Processor % Privileged Time** counter represent?
| ***Processor*** is the object; **% Privileged Time** is the counter
## Footnote
In Performance Monitor, an object is a group of related counters, and a counter measures a specific system performance metric.
System CPU usage
| Percentage of time spent on system processes.
86
What does the **Processor % User Time** counter represent?
| ***Processor*** is the object; **% User Time** is the counter
## Footnote
In Performance Monitor, an object is a group of related counters, and a counter measures a specific system performance metric.
User CPU usage
| Percentage of time spent on apps
87
What does the **Physical Disk % Disk Time** counter measure?
| ***Physical Disk*** is the object; **% Disk Time** is the counter
## Footnote
In Performance Monitor, an object is a group of related counters, and a counter measures a specific system performance metric.
Disk utilization
| Percentage of time the disk is busy with read/write requests
88
What indicates a disk problem when monitoring **% Disk Time**?
## Footnote
a counter measures a specific system performance metric
If average is over 85% for a sustained period.
89
(DELETE) What does the **Average Disk Queue Length** counter represent?
## Footnote
a counter measures a specific system performance metric
The number of pending disk requests during data collection
90
What should the **Available Bytes** counter not fall below?
## Footnote
a counter measures a specific system performance metric
10% of total system RAM.
91
What does a continuous fall in **Available Bytes** indicate?
## Footnote
a counter measures a specific system performance metric
Memory leak.
92
What does the **Pages/sec** counter measure?
## Footnote
a counter measures a specific system performance metric
Page file I/O for hard faults
| Number of pages read/written to disk for hard page faults
## Footnote
Hard page faults occur when data needed by a program is not in RAM and must be retrieved from the disk (paging file).
93
What is the threshold for excessive paging indicated by **Pages/sec** counter?
## Footnote
a counter measures a specific system performance metric
Averaging above about 50.
94
[DELETE] What does the **Paging File % Usage** counter represent?
| ***Paging File*** is the object; **% Usage** is the counter
## Footnote
In Performance Monitor, an object is a group of related counters, and a counter measures a specific system performance metric.
Percentage of pagefile instance in use
## Footnote
A pagefile instance refers to a specific paging file on a disk. The paging file is a portion of disk space used as virtual memory when the physical RAM is full
95
If your paging file is 1000 MB and **% Usage** averages 50%, what does that imply?
You might benefit from adding 500 MB of memory.
## Footnote
If the paging file is using 50% of its capacity, adding more RAM (500MB in this case) would reduce reliance on the slower paging file, improving system performance.
96
What can low system memory indicate about disk performance?
Disk may slow from high paging
97
What can you adjust in the System Configuration Utility (msconfig.exe)?
Adjust boot settings & startup files
## Footnote
It is often used for diagnostic purposes rather than permanent configuration changes.
98
What does the **Boot** tab in System Configuration Utility allow you to configure?
Basic settings in the Boot Configuration Data (BCD) store
| Including changing the default OS & adding boot options
## Footnote
Boot options like Safe Mode can be configured here. The BCD store is a Windows database that holds boot configuration settings, including OS details, boot options, and recovery settings, used by the Boot Manager to start the system.
99
How can you add boot paths in the **Boot** tab (System Configuration Utility)?
## Footnote
Boot paths are the file system locations and configurations used by an OS to locate and load essential files during the startup process
via `bcdedit` command.
## Footnote
This is run via cmd prompt; cmd prompt needs to be run as admin
100
What should you check if a system keeps using safe boot or boots to a command prompt?
Verify System Configuration settings to ensure options aren’t permanent.
101
What does the **Services** tab (System Configuration Utility) allow to do?
Choose which services run at startup
| It alos shows the date a service was disabled
102
What does the **Tools** tab in the System Configuration Utility contain?
Shortcuts to admin utilities
## Footnote
i.e. System Information, Registry Editor, & Performance Monitor
103
True or False: The boot log file created by msconfig is shown in Event Viewer.
False
104
What do frequent page faults indicate during performance monitoring
The system relies heavily on the pagefile & may need more RAM
105
is it a problem if the CPU usage often jumps to 100% & then falls back?
| (in task manager)
No
## Footnote
CPU spikes are normal, but sustained 80-90% usage may need a faster CPU or signal a faulty app
106
What does it mean if a program runs at startup, but is not in the Startup folder?
Program has added a registry entry to run at startup
| Can be disabled via Task Manager
107
What tool is this?
System Information tool
## Footnote
This tool procudes a hardware & software inventory report
108
What is the command to open the Sytem Information tool?
`msinfo32.exe`
## Footnote
This tool procudes a hardware & software inventory report
109
2 Ways to access Task Manager?
- **Ctrl**+**Alt**+**Del**
- **Ctrl**+**Shift**+**Esc**
110
How to run a command that requires elevated privileges?
Open command prompt as administrator.
## Footnote
You can do this by right-clicking command prompt & selecting **Run as administrator**
111
What is the default folder when the command prompt is run as administrator?
C:\Windows\System32
112
What command can be used to clear the command prompt screen?
`cls`
113
What should you do if an argument includes a space?
Enter it within quotes.
| i.e. `cd "C:\Program Files\My Application"`
114
What command is used to exit an interactive program?
| interactive programs like telnet, etc.
`exit` or `quit`
115
what command lists available commands in the command prompt?
`help`
116
2 ways to list the syntax & switches for a command?
- `help [command]`
- `[command] /?`
## Footnote
i.e. `help cd` & `cd /?`
117
True or False: You can continue using the same command prompt window if you need to run a command that requires elevation.
False
118
What is the effect of using the forward slash escape character in command syntax?
| i.e. `dir /s`
Precedes switches.
119
What command is used to list the files and subdirectories?
dir
## Footnote
The dir command can be used to list files from the working drive or a specified path.
120
What switch is used with the dir command to present files in a particular order?
/o:x
| i.e. `dir /o:n`
## Footnote
The x can be n (name), s (size), e (extension), or d (date).
121
Which switch is used to set the date field for the dir command?
/t:x
| i.e. `dir /t:x`
## Footnote
The x can be c (created on), a (last access), or w (last modified).
122
What does the /a:x switch do in the dir command?
Displays files with the attribute indicated by x
## Footnote
The attributes can be r (Read-only), h (hidden), s (system), or a (archive).
123
What wildcard character represents a single unspecified character?
?
## Footnote
For example, dir ????????.log displays all .log files with eight characters in the file name.
124
How do you change to a specific directory using the cd command?
Enter the full path
## Footnote
Example: cd C:\Users\David
125
What command would you use to move up to the parent directory?
cd ..
## Footnote
This command moves you one level up in the directory structure.
126
How do you change to the root directory of the drive?
cd \
## Footnote
This command takes you to the root directory.
127
What command is used to change the working drive?
Enter the drive letter followed by a colon
## Footnote
Example: D: changes to the D drive.
128
What is the syntax for the move and copy commands?
[command] [Source] [Destination]
| i.e. (`move file.txt C:\Documents`) (`copy file.txt C:\Backup)
## Footnote
'Source' is the drive name, path, and name of the files, while 'Destination' is the drive name and path of the new location.
129
What utility allows you to copy multiple directories while retaining the directory structure?
xcopy
| i.e. `xcopy C:\SourceFolder D:\DestinationFolder /E /I`
## Footnote
The syntax for xcopy is: xcopy Source [Destination] [Switches].
130
What is the primary advantage of using robocopy over xcopy?
robocopy works better with long file names and NTFS attributes
## Footnote
Microsoft now recommends using robocopy rather than xcopy.
131
What is the command to create a new directory?
md or mkdir
## Footnote
Example: To create a directory called Data, type md Data.
132
Which command is used to delete an empty directory?
`rd [Directory]` or `rmdir [Directory]`
## Footnote
Use /s switch to remove non-empty directories.
133
What is the purpose of the `/s` switch in the `rmdir` command?
| i.e. rmdir `C:\TestFolder /s`
To remove files and subdirectories from a directory
## Footnote
Also, the /q switch can be used to suppress confirmation messages.
134
What characters can't folders/files contain?
- `\ /`
- `:`
- `*`
- `?`
- `"`
- `< >`
- `|`
## Footnote
These characters are not allowed in folder and file names.
135
What switch can be used to move files using robocopy?
`/mov`
| i.e. `robocopy C:\SourceFolder D:\DestinationFolder /mov`
## Footnote
Despite its name, robocopy can also move files.
136
What does the `xcopy` command allow you to do?
| i.e. `xcopy C:\SourceFolder D:\DestinationFolder /e /i`
Copy the contents of more than one directory at a time
## Footnote
It retains the directory structure.
137
True or False: The robocopy command is primarily used for copying files only.
False
## Footnote
robocopy can also move files using the /mov switch.
138
How to inspect disks using `diskpart`?
Run the diskpart utility and enter `select disk 0`
139
What command displays configuration info for a selected disk in `diskpart`?
`detail disk`
140
What does `diskpart` report if the hard disk has no partitions?
`The partition table may have become corrupted`
141
What command do you use to select a partition in `diskpart`?
`select partition 0` or select `volume 0`.
142
What command is used to view information about a selected partition or volume in `diskpart`?
`detail partition` or `detail volume`
143
3 commands you can use after selecting a partition or volume in diskpart?
* assign
* delete
* extend
## Footnote
`assign` changes the drive letter, `delete` destroyes the volume, `extend` extends the size
144
What does the `format` command do?
| i.e. `format D: /fs:NTFS`
Writes a new file system to a drive, deleting existing data.
145
What is the basic syntax of the format command?
format **X**: /fs:**SYS**
| **X** is the drive letter; **SYS** is the file system
## Footnote
i.e. `format D: /fs:NTFS`
146
What does the /q switch do in the `format` command?
| i.e. `format D: /fs:NTFS /q`
Skips the scan for bad sectors.
| This makes the process faster
## Footnote
Sectors are the smallest physical storage units on a disk
147
What happens during both standard and quick `format` operations?
Removes references to existing files in the volume boot record.
## Footnote
During a format, the system removes the file references in the file system (like NTFS or FAT32), which are pointers to where data is stored on the disk. The data itself isn’t immediately erased, but the space is marked as available for reuse.
148
Can data be recovered from a formatted disk?
Yes, using third-party tools.
149
What is a secure format utility?
Tool that overwrites sectors with a zero value, preventing data recovery
## Footnote
A sector is the smallest data unit on a disk, where written data is stored. Secure format utilities like the Cipher command (Windows) and third-party tools overwrite data to prevent recovery.
150
What does the `chkdsk` command do?
Scans the file system and/or disk sectors for faults and attempts repairs.
## Footnote
A sector is the smallest data unit on a disk, where written data is stored.
151
What is the command to run chkdsk in read-only mode?
chkdsk X:.
| `chkdsk C:`
152
What does the `chkdsk X: /f` command do?
| `chkdsk C: /f`
Attempts to fix file system errors.
153
What does the `chkdsk X: /r` command do?
| `chkdsk C: /r`
Fixes file system errors and attempts recovery of bad sectors.
## Footnote
A sector is the smallest data unit on a disk, where written data is stored.
154
What happens if `chkdsk` detects recoverable data?
It is copied to the root directory as `filennnn.chk` files.
155
True or False: Check Disk tool can fix open files.
| (meaning files in use)
False.
156
What is recommended before running `chkdsk /f` or `chkdsk /r`?
Run a read-only scan first.
| Which is done via `chkdsk C:`
157
What is the command to safely halt the system?
shutdown /s
## Footnote
This command closes all open programs and services before powering off the computer.
158
What does the command `shutdown /h` do?
Saves current session to disk before powering off PC
## Footnote
This is known as hibernation.
159
What is the purpose of the `shutdown /l` command?
Logs off the user account while leaving the computer running
## Footnote
This closes all programs and services started under the user account.
160
What does `shutdown /r` do?
Restarts PC without powering it down
## Footnote
This is also referred to as a soft reset.
161
What does the `shutdown /s /t nn` command do?
| "nn" would be replaced with a number
Specifies a timer before shutdown starts
## Footnote
The default delay is 30 seconds if no number is provided
162
What command aborts a shutdown in progress?
`shutdown /a`
## Footnote
This command must be used quickly enough to be effective.
163
What is the function of the System File Checker (`sfc`)?
Verifies & restores corrupt system files from cache
## Footnote
It provides a manual interface for this process.
164
What does the command `sfc /scannow` do?
Runs a scan immediately
## Footnote
This checks for corrupt system files right away.
165
What does `sfc /scanonce` do?
Schedules a scan for the next computer restart
## Footnote
This allows for a one-time scan at the next boot.
166
What does `sfc /scanboot` do?
Schedules a scan to run at each PC boot
## Footnote
This ensures continuous monitoring of system files.
167
Where are system files maintained in Windows?
`WINSxS` system folder
## Footnote
This folder is version-controlled and can consume significant disk space.
168
What does the `winver` command report?
Version information of Windows
## Footnote
This is often needed for support purposes.
169
What does the *Version* refer to in Windows version information?
| Examples include 1607 (July 2016) or 21H1 (first half of 2021).
A feature update via a year/month code
170
What is the OS Build in Windows version information?
Code showing brand & update status
## Footnote
The rev number can be used to look up changes and known issues.
171
Which is more informative for Windows version details, `winver` or the About settings page?
The About settings page
## Footnote
It lists edition and license information in addition to version details.
172
How do you perform a scan to idetify file system errors in read-only mode?
run `chkdsk` in command prompt
173
Which Windows command is ideal for scripting file backups?
## Footnote
Scripting file backups means using a command-line tool or script to automate the process of copying or archiving files for backup purposes
`robocopy`
174
What console monitors live CPU, memory, disk, and network usage?
A. certmgr.msc
B. taskschd.msc
C. resmon.exe
D. gpedit.msc
C. resmon.exe
175
An incident handler is reviewing a possible cryptomining infection on one of the corporate servers. What should the handler use first to investigate?
A. eventvwr.msc
B. taskmgr.exe
C. regedit.exe
D. taskschd.msc
B. taskmgr.exe
176
Which command helps investigate malware replacing system files?
A. sfc
B. chkdsk
C. winver
D. shutdown
A. sfc
## Footnote
Windows Resource Protection safeguards system files and registry keys. The System File Checker (sfc) verifies and restores corrupt system files from cache.
177
Which option helps improve system security after patching is improved?
A. msinfo32.exe
B. resmon.exe
C. services.msc
D. dfrgui.exe
C. services.msc
## Footnote
From Task Manager, the Open Services button links to the Services (services.msc) console. This can disable nonessential services to improve performance or security.
178
How can a user change the default OS in a dual-boot setup?
A. msconfig.exe
B. resmon.exe
C. taskschd.msc
D. gpedit.msc
A. msconfig.exe
## Footnote
The System Configuration Utility (msconfig.exe) modifies boot settings, like changing the default OS, adding boot options, and setting the timeout value.
179
Which cmmand should a Windows server use to transfer logs to a central security platform via a script?
A. xcopy Source [Destination] [Switches]
B. md Source [Destination] [Switches]
C. robocopy Source [Destination] [Switches]
D. rmdir Source [Destination] [Switches]
C. robocopy Source [Destination] [Switches]
## Footnote
Robocopy is a file copy utility recommended by Microsoft over xcopy, as it handles long file names and NTFS attributes better.
180
What tool should a server administrator use for resource performance graphs and statistics?
A. taskmgr.exe
B. services.msc
C. msconfig.exe
D. resmon.exe
D. resmon.exe
## Footnote
Resource Monitor (resmon.exe) shows an enhanced version of the type of snapshot monitoring provided by the Task Manager.
181
Which command should a user run to diagnose issues with large files?
A. format
B. diskpart
C. chkdsk
D. winver
C. chkdsk
182
What should a technician use to optimize HDD input/output operations performance?
A. devmgmt.msc
B. dfrgui.exe
C. resmon.exe
D. secpol.msc
B. dfrgui.exe
## Footnote
The Defragment and Optimize Drives tool (dfrgui.exe) runs various operations to speed up the performance of hard disk drives (HDDs).
183
What is the best way for a security admin. to push configuration changes to users?
A. regedit.exe
B. services.msc
C. lusrmgr.msc
D. gpedit.msc
D. gpedit.msc
## Footnote
The Group Policy Editor (gpedit.msc) provides a more robust means of configuring many of these Windows settings than editing the registry directly.
184
Where should a user check for changes after experiencing a BSoD on startup?
A. WSL
B. devmgmt.msc
C. taskschd.msc
D. services.msc
B. devmgmt.msc
## Footnote
Most BSoDs, especially during startup, are caused by faulty hardware or drivers. Device Manager (devmgmt.msc) lets users view and edit hardware properties.
