Windows XP Pro Research & Evidence-Based Practice 4 — Questions and Answers
Question 1: A Windows XP technician must document which processes are using specific TCP ports. Which command provides this evidence?
- netstat -ano (Correct answer)
- tasklist /svc
- ipconfig /all
- netstat -e
Correct answer: netstat -ano
Netstat -ano lists all active connections with the owning process ID (PID), enabling cross-reference with Task Manager.
Question 2: Which Windows XP log file records the results of a chkdsk scan run at next boot?
- System Event Log
- C:\Windows\SchedLgU.txt
- Chkdsk writes results to the Application Event Log (Correct answer)
- C:\Windows\bootstat.dat
Correct answer: Chkdsk writes results to the Application Event Log
Chkdsk results from an offline boot-time scan are written to the Application Event Log under source Winlogon with Event ID 1001.
Question 3: A security auditor needs evidence of all local accounts and their group memberships on a Windows XP Pro machine. Which command is best?
- net localgroup administrators
- net user
- wmic useraccount list full (Correct answer)
- lusrmgr.msc /export
Correct answer: wmic useraccount list full
WMIC useraccount list full returns all local accounts with detailed attributes including SID, disabled status, and password age.
Question 4: To research the boot sequence and identify startup programs causing slow boot on Windows XP, which tool is used?
- msconfig.exe (Correct answer)
- bootcfg.exe
- ntbtlog.txt analysis
- regedit startup key review
Correct answer: msconfig.exe
Msconfig (System Configuration Utility) displays and controls startup programs, services, and boot options with checkboxes for systematic elimination.
Question 5: Which Windows XP feature creates a time-stamped restore point log that can serve as evidence of system configuration changes?
- Backup utility (ntbackup)
- System Restore change log (Correct answer)
- Volume Shadow Copy
- Scheduled Tasks log
Correct answer: System Restore change log
System Restore maintains a log of restore points with timestamps and descriptions, documenting when system state changes occurred.
Question 6: A technician wants documented evidence of all shared folders on a Windows XP Pro machine including administrative shares. Which command is used?
- net share (Correct answer)
- net use
- netstat -a
- cacls /t c:\
Correct answer: net share
Net share lists all shared resources including hidden administrative shares (C$, ADMIN$, IPC$) with their local paths and remarks.
Question 7: When applying the evidence-based troubleshooting principle of change isolation on Windows XP, which tool rolls back a problematic driver?
- System Restore
- Roll Back Driver button in Device Manager (Correct answer)
- Add/Remove Programs
- Recovery Console extract command
Correct answer: Roll Back Driver button in Device Manager
Device Manager's Roll Back Driver button replaces the current driver with the previously installed version, isolating driver changes as the cause.
Windows XP Pro Research & Evidence-Based Practice 4
A Windows XP technician must document which processes are using specific TCP ports.
Which command provides this evidence?