Windows XP Pro Research & Evidence-Based Practice 2 — Questions and Answers
Question 1: A technician suspects a Windows XP driver is causing system instability. Which tool provides signed-driver verification evidence?
- Device Manager
- File Signature Verification (sigverif.exe) (Correct answer)
- System Information (msinfo32)
- Dr. Watson
Correct answer: File Signature Verification (sigverif.exe)
Sigverif.exe scans for unsigned drivers and logs results to sigverif.txt, providing documented evidence of unsigned files.
Question 2: When researching a Windows XP stop error (BSOD), which file contains the most detailed crash dump data by default?
- Application.evt
- minidump files in %SystemRoot%\Minidump (Correct answer)
- Dr. Watson log (drwtsn32.log)
- System.evt
Correct answer: minidump files in %SystemRoot%\Minidump
Windows XP writes kernel minidump files to %SystemRoot%\Minidump by default, containing CPU register state and loaded driver list at crash time.
Question 3: Which Windows XP command-line tool retrieves detailed hardware and OS inventory data suitable for documenting a baseline?
- systeminfo.exe (Correct answer)
- winver.exe
- dxdiag.exe
- msconfig.exe
Correct answer: systeminfo.exe
Systeminfo.exe outputs OS version, hotfixes, hardware specs, and network configuration in a single readable report.
Question 4: A technician needs evidence of which Windows XP hotfixes are installed on a PC before applying a new patch. Which command is most efficient?
- wmic qfe list (Correct answer)
- net statistics workstation
- gpresult /v
- arp -a
Correct answer: wmic qfe list
WMIC's QFE (Quick Fix Engineering) class lists all installed hotfixes with KB numbers and installation dates.
Question 5: Which Event Viewer log should be checked first for evidence of a failed Windows XP service startup?
- Security log
- Application log
- System log (Correct answer)
- Directory Service log
Correct answer: System log
The System log records service control manager events including failed service startups with associated error codes.
Question 6: To research Group Policy settings applied to a Windows XP workstation, which command produces a verbose evidence report?
- gpresult /v (Correct answer)
- secedit /analyze
- net group /domain
- runas /showtrustlevels
Correct answer: gpresult /v
Gpresult /v (verbose) lists all applied GPOs, their source, and individual policy settings for both user and computer contexts.
Question 7: A Windows XP machine has intermittent network drops. Which tool captures packet-level evidence natively without third-party software?
- Netstat -e
- Network Monitor (netmon.exe) if installed via Support Tools (Correct answer)
- IPConfig /all
- Tracert
Correct answer: Network Monitor (netmon.exe) if installed via Support Tools
Network Monitor is included in Windows XP Support Tools and can capture raw packets for analysis, though it must be installed separately from the XP CD.
Windows XP Pro Research & Evidence-Based Practice 2
A technician suspects a Windows XP driver is causing system instability.
Which tool provides signed-driver verification evidence?