Windows XP Pro Case Studies & Practical Application 3 — Questions and Answers
Question 1: A Windows XP Pro machine on a corporate network is infected with malware. IT policy requires preserving evidence. What should be done FIRST?
- Isolate the machine from the network by disconnecting the network cable (Correct answer)
- Run antivirus software immediately
- Reboot the machine to clear active malware
- Reformat the hard drive
Correct answer: Isolate the machine from the network by disconnecting the network cable
Isolating the machine prevents malware from spreading or communicating while preserving system state for forensic analysis.
Question 2: Users report that shared folders on a Windows XP Pro machine are accessible but files cannot be modified. NTFS permissions allow Full Control. What else should be checked?
- Share permissions, which may only grant Read access (Correct answer)
- The NTFS compression setting on the folder
- The Recycle Bin size limit
- Whether Offline Files is enabled
Correct answer: Share permissions, which may only grant Read access
Effective permissions are determined by the more restrictive of NTFS and share permissions, so Read-only share permissions override Full Control NTFS permissions.
Question 3: A Windows XP Pro computer stops responding randomly and reboots. Event Viewer shows stop errors. What should be configured to capture full crash data?
- Set System Failure to write a complete memory dump and note the minidump path
- Increase the page file size only
- Disable automatic restart on system failure to read the stop code (Correct answer)
- Run Disk Cleanup to free space
Correct answer: Disable automatic restart on system failure to read the stop code
Disabling automatic restart allows the blue screen stop code to remain visible long enough to be recorded for diagnosis.
Question 4: A technician is deploying Windows XP Pro to 50 identical machines. Which tool allows creating an unattended installation with pre-configured settings?
- Sysprep combined with an answer file (unattend.txt) (Correct answer)
- Remote Desktop Connection
- Device Manager
- Windows Update
Correct answer: Sysprep combined with an answer file (unattend.txt)
Sysprep generalizes the installation and an answer file automates responses during setup, enabling consistent unattended deployment across identical hardware.
Question 5: After migrating user profiles to a new Windows XP Pro machine using USMT, a user cannot open encrypted EFS files. What step was missed?
- The user's EFS certificate and private key were not exported and imported (Correct answer)
- NTFS permissions were not set on the new machine
- The user's profile folder ownership was not transferred
- The EFS service was not started on the new machine
Correct answer: The user's EFS certificate and private key were not exported and imported
EFS-encrypted files require the user's private key certificate to decrypt; without migrating the certificate, files remain inaccessible even to their owner.
Question 6: A remote Windows XP Pro machine needs administrative maintenance but no one is physically available. Which built-in Windows XP feature enables secure remote access to the desktop?
- Remote Desktop (Terminal Services client) (Correct answer)
- Telnet service
- IIS web management
- Net Meeting only
Correct answer: Remote Desktop (Terminal Services client)
Remote Desktop in Windows XP Pro allows authorized users to connect to and control the desktop remotely over RDP on port 3389.
Question 7: A Windows XP Pro workstation's IP address keeps changing, causing it to drop off a network-mapped drive. What is the BEST long-term solution?
- Assign a DHCP reservation for the workstation's MAC address or configure a static IP (Correct answer)
- Reconnect the mapped drive each morning
- Disable the network adapter and reconnect it
- Set the DNS suffix manually
Correct answer: Assign a DHCP reservation for the workstation's MAC address or configure a static IP
A DHCP reservation ensures the workstation always receives the same IP, keeping mapped drives and other network resources consistently reachable.
Windows XP Pro Case Studies & Practical Application 3
A Windows XP Pro machine on a corporate network is infected with malware.
IT policy requires preserving evidence.
What should be done FIRST?