Windows XP Pro Research & Evidence-Based Practice 5 — Questions and Answers
Question 1: A technician needs to document Windows XP audit policy settings as evidence of security compliance. Which tool exports this data?
- Secedit /export /cfg output.inf (Correct answer)
- Gpresult /z
- Net accounts
- Secpol.msc screenshot only
Correct answer: Secedit /export /cfg output.inf
Secedit /export /cfg generates an .inf file containing all current security policy settings including audit policies for documentation.
Question 2: Which Windows XP built-in tool can compare current security settings against a known-good security template to identify deviations?
- Security Configuration and Analysis (mmc snap-in) (Correct answer)
- Secedit /validate
- Group Policy Editor
- Baseline Security Analyzer
Correct answer: Security Configuration and Analysis (mmc snap-in)
The Security Configuration and Analysis snap-in analyzes a system against an .inf security template and highlights discrepancies in a color-coded report.
Question 3: To gather evidence of Windows XP patch compliance, a technician runs the Microsoft Baseline Security Analyzer. Where are MBSA results stored?
- Event Viewer Security log
- .xml report files in %USERPROFILE%\SecurityScans
- .mbsa XML report files in the user's SecurityScans folder (Correct answer)
- C:\Windows\System32\mbsalog.txt
Correct answer: .mbsa XML report files in the user's SecurityScans folder
MBSA saves scan results as .mbsa XML files in the user's SecurityScans folder, allowing later review and comparison.
Question 4: A Windows XP workstation is behaving unexpectedly after a Group Policy update. Which command forces a GP refresh and logs applied policies?
- gpupdate /force (Correct answer)
- secedit /refreshpolicy machine_policy /enforce
- net logon /refresh
- gpfix /log
Correct answer: gpupdate /force
Gpupdate /force reapplies all Group Policy settings immediately; combining with gpresult afterward documents which policies took effect.
Question 5: A technician wants to verify Windows XP file system integrity using evidence from the OS itself. Which command scans and repairs system files?
- chkdsk /r
- sfc /scannow (Correct answer)
- defrag c: /v
- fsutil dirty query c:
Correct answer: sfc /scannow
Sfc /scannow (System File Checker) scans all protected system files and replaces corrupted ones, logging results to %windir%\logs\cbs\cbs.log.
Question 6: Which Windows XP event ID in the Security log provides evidence that a user account was locked out?
- Event ID 529
- Event ID 539
- Event ID 644 (Correct answer)
- Event ID 680
Correct answer: Event ID 644
Event ID 644 (Account locked out) is logged in the Security event log when an account exceeds the failed-logon threshold.
Question 7: To document all running services and their start types on a Windows XP system as a configuration baseline, which command is best?
- net start
- sc query type= all state= all (Correct answer)
- services.msc export
- tasklist /svc
Correct answer: sc query type= all state= all
Sc query with type=all and state=all returns every service including stopped ones with their current state and configuration type.
Windows XP Pro Research & Evidence-Based Practice 5
A technician needs to document Windows XP audit policy settings as evidence of security compliance.
Which tool exports this data?