Windows

Front 1

ties clusters together

Back 1

linked allocation

Front 2

kernel operates in ring ___ and ___

Back 2

0 and 3
kernel and user

Front 3

____ are the building blocks for programmers

Back 3

API

Front 4

in windows ___ and API's are used to allow abstraction (removing the user from the inner processes of windows)

Back 4

dll's

Front 5

single runtime instance of a statically defined function in kernel mode

Back 5

object

Front 6

lowest layer dll

Back 6

hal

Front 7

kernel 2 modes

Back 7

executive and kernel

Front 8

exe that runs executive and kernel modes

Back 8

ntoskernel.exe

Front 9

___ does priviliged actions with the hal

Back 9

kernel

Front 10

4 main kernel responsibilities

Back 10

thread sched
interupt exception handling
low level processor synch
recovery after a power failure

Front 11

provides standard interface for every object in the system

Back 11

object manager

Front 12

windows executive that creates manages terminates processes and threads

Back 12

process mgr

Front 13

windows executive provides a private address space for each process

Back 13

virt mem mgr

Front 14

windows executive that processes file and i/o requests

Back 14

i/o mgr

Front 15

windows executive that enforces sec.

Back 15

sec. ref. mon.

Front 16

2 main types of objects

Back 16

kernel objects and executive objects

Front 17

these objects allow environment subsystems to create their own objects

Back 17

executive objects

Front 18

3 main things in an object header

Back 18

obj name
security descriptor
object type

Front 19

handles are in the object ____

Back 19

header

Front 20

2 phases that allow deletion of objects

Back 20

name retention and deleting the object

Front 21

windows will delete objects if there are no ____ or ____

Back 21

handles or pointers

Front 22

mechanism to refer to an object indirectly

Back 22

symbolic link

Front 23

6 resources for processes

Back 23

1 virtual address space
2 executable program
3 list of open handles
4 access token
5 PID
6 thread

Front 24

how a process opens (6 steps)

Back 24

1 image of file
2 create windows executive process object
3 create initial thread
4 notify subsystem
5 start execution of thread
6 complete initialization of address space & execute program

Front 25

2 functions of VMM

Back 25

give each process its own page directory

each index has its own page index

Front 26

pages can be ____, ____, or _____

Back 26

free reserved commited

Front 27

executive that controls shared memory

Back 27

vmm

Front 28

heap manager exists in these 2 dll's

Back 28

ntdll and ntoskernel

Front 29

responsible for memory allocations inside larger memory areas

Back 29

heap mgr

Front 30

____ are used to keep track of which virtual addresses have been reserved, & which have not

Back 30

VAD

Front 31

what is the IRP

Back 31

I/O request packet - used to communicate with system components and locate stack positions

Front 32

what is called when a process opens a handle to an object?

Back 32

SRM

Front 33

this handles windows client server methodology

Back 33

local procedure call

Front 34

this executive has lists of devices, loads drivers, sends start requests

Back 34

P&P mgr

Front 35

runs posix and os/2

Back 35

WSS

Front 36

exe for WSS

Back 36

csrss.exe

Front 37

native API

Back 37

ntdll.dll

Front 38

kernel portion of the WSS

Back 38

win32k.sys

Front 39

dividing line between user mode and kernel mode

Back 39

ntdll.dll

Front 40

3 dll's in the WSS

Back 40

kernel32.dll
user32.dll
gdi32.dll

Front 41

this service is responsible for mgt of database that contains users/groups on the local machine

Back 41

SAM

Front 42

SAM runs in context of ____ process

Back 42

lsass

Front 43

executive responsible for registry

Back 43

configuration mgr

Front 44

conditions that divert processor to code outside the normal flow of control

Back 44

interupts and exceptions

Front 45

used to capture thread when interrupt occurs

Back 45

trap dispatching

Front 46

processes exceptions & interrupts and transfers control

Back 46

trap handler

Front 47

interrupts are in priority order...

Back 47

high number = high pri

Front 48

kernel allows devices to register these interrupts

Back 48

interrupt service routines

Front 49

single volume over multi disks

Back 49

spanning

Front 50

raid 0

Back 50

striping +speed/-redundancy

Front 51

raid 1

Back 51

mirroring -space/+redundancy

Front 52

raid 5

Back 52

striping w/parity -space/+redundancy

Front 53

FAT directory entries contain these 3 things

Back 53

address size and date

Front 54

in FAT these tie clusters together

Back 54

linked allocation

Front 55

in FAT there can be how many primary partitions

Back 55

4

Front 56

cluster sizes are created during ____

Back 56

formatting

Front 57

in a FAT table layout this contains the boot record and OS info

Back 57

reserved

Front 58

in a FAT table layout, this area conducts cluster mgt

Back 58

FAT area

Front 59

in a FAT table layout, this area has file storage and root directory

Back 59

Data Area

Front 60

FAT time stamps are local?

Back 60

yes, local to machine

Front 61

which time is only accurate to the day?

Back 61

last access time

Front 62

can you encrypt and compress in NTFS?

Back 62

nope

Front 63

the heart of NTFS

Back 63

MFT

Front 64

MFT has an entry for itself?

Back 64

yes

Front 65

NTFS entries begin with this symbol

Back 65

$

Front 66

entries 0-? are reserved for metadata

Back 66

15

Front 67

1k files are called ___ because the whole file resides in the MFT (NTFS)

Back 67

resident

Front 68

Files larger than 1k (NTFS) are considered

Back 68

non-resident

Front 69

instead of linked allocation tables, NTFS uses:

Back 69

VCN to LCN

Front 70

NTFS best true time stamp

Back 70

$standard_information

Front 71

shows the parent directory in this NTFS entry

Back 71

$file_name

Front 72

where root kits can be installed in this NTFS entry

Back 72

$data

Front 73

this NTFS entry shows directories and subdirectories like a tree

Back 73

$index_root

Front 74

encryption entries in NTFS

Back 74

$obj_id
$efs

Front 75

what 5 things trigger a restore point

Back 75

app installation
auto update
backup recovery
manual
daily

Front 76

xp backups use this form

Back 76

shadow copy

Front 77

5 boot sections

Back 77

preboot
boot
kernel load
kernel init
logon

Front 78

key boot files

Back 78

ntldr and ntdetect

Front 79

during boot, this switches user to protected mode

Back 79

ntldr

Front 80

first 512 byte sector

Back 80

MBR

Front 81

MBR contains these 3 things for boot

Back 81

partition table
boot sector
OS control flag