Windows XP Pro Research & Evidence-Based Practice 3 — Questions and Answers
Question 1: Which Windows XP built-in resource allows a technician to search Microsoft's documented solutions by error code without internet access?
- Help and Support Center offline content (Correct answer)
- Event Viewer descriptions
- Dr. Watson log
- Recovery Console help
Correct answer: Help and Support Center offline content
Windows XP's Help and Support Center includes offline documentation and links to error code explanations even without an internet connection.
Question 2: A technician is documenting evidence of unauthorized software installs on a Windows XP system. Which registry hive is the primary source?
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall (Correct answer)
- HKEY_CURRENT_USER\Software\Policies
- HKEY_CLASSES_ROOT\Applications
Correct answer: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
The Uninstall key lists all programs registered for Add/Remove Programs, providing a documented inventory of installed software.
Question 3: When researching Windows XP performance degradation, which tool provides a historical log of CPU, memory, and disk counters?
- Task Manager
- Performance Logs and Alerts (perfmon.exe) (Correct answer)
- System Monitor real-time view
- Resource Monitor
Correct answer: Performance Logs and Alerts (perfmon.exe)
Performance Logs and Alerts can record counter data to log files over time, enabling evidence-based before/after comparison.
Question 4: A user reports that a specific application crashes repeatedly on Windows XP. Where does Dr. Watson store its crash evidence by default?
- C:\Windows\System32\LogFiles
- C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson (Correct answer)
- C:\Windows\Minidump
- C:\Windows\Temp
Correct answer: C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson
Dr. Watson saves drwtsn32.log and user.dmp files to the Dr Watson folder under All Users Application Data by default.
Question 5: To verify whether a Windows XP system's TCP/IP stack is intact before escalating a network issue, which evidence-gathering command is used?
- ping 127.0.0.1 (Correct answer)
- ipconfig /flushdns
- netsh int ip reset
- arp -d
Correct answer: ping 127.0.0.1
Pinging the loopback address 127.0.0.1 confirms the TCP/IP stack is functional independent of physical network hardware.
Question 6: Which Windows XP utility generates a comprehensive report of hardware resources, conflicts, and IRQ assignments for research documentation?
- System Information (msinfo32.exe) (Correct answer)
- Device Manager
- Computer Management
- Hardware Wizard
Correct answer: System Information (msinfo32.exe)
Msinfo32 generates exportable reports covering hardware resources, conflicts, IRQs, DMA channels, and software environment details.
Question 7: A technician wants evidence of DNS queries made by a Windows XP machine. Which command enables DNS client-side debug logging?
- ipconfig /displaydns (Correct answer)
- netsh diag show dns
- dnscmd /recordadd
- nslookup -debug
Correct answer: ipconfig /displaydns
Ipconfig /displaydns shows the contents of the local DNS resolver cache, revealing recently resolved names and their TTLs.
Windows XP Pro Research & Evidence-Based Practice 3
Which Windows XP built-in resource allows a technician to search Microsoft's documented solutions by error code without internet access?