Windows XP Pro Research & Evidence-Based Practice 4

Question 1

A Windows XP technician must document which processes are using specific TCP ports. Which command provides this evidence?

Accepted Answer

netstat -ano

Answer

Netstat -ano lists all active connections with the owning process ID (PID), enabling cross-reference with Task Manager.

Question 2

Which Windows XP log file records the results of a chkdsk scan run at next boot?

Accepted Answer

Chkdsk writes results to the Application Event Log

Answer

Chkdsk results from an offline boot-time scan are written to the Application Event Log under source Winlogon with Event ID 1001.

Question 3

A security auditor needs evidence of all local accounts and their group memberships on a Windows XP Pro machine. Which command is best?

Accepted Answer

wmic useraccount list full

Answer

WMIC useraccount list full returns all local accounts with detailed attributes including SID, disabled status, and password age.

Question 4

To research the boot sequence and identify startup programs causing slow boot on Windows XP, which tool is used?

Accepted Answer

msconfig.exe

Answer

Msconfig (System Configuration Utility) displays and controls startup programs, services, and boot options with checkboxes for systematic elimination.

Question 5

Which Windows XP feature creates a time-stamped restore point log that can serve as evidence of system configuration changes?

Accepted Answer

System Restore change log

Answer

System Restore maintains a log of restore points with timestamps and descriptions, documenting when system state changes occurred.

Windows XP Pro Practice Test

Windows XP Pro Practice Test

Windows XP Pro Research & Evidence-Based Practice 4