Microsoft TS Windows Internals

You work a windows developer at the london office of Company.com. the Company.com network consists of a single active directory domain named Company.com. Company.com currently makes use of a computer named -sr01 which runs windows server 2008. during the course of the day you travel to the miami branch office and deploy a workstation named -ws21. whilst making use of -ws21 you discover that the lsass process makes use of the majority cpu timE. You have later received instruction from Company.com to generate a complete memory dump of - ws21. Company.com wants you to view the kernel-mode and user-mode stacks of all threads in the lsass process. What should you do?

You work a windows developer at Company.com. the Company.com network consists of a single active directory domain named Company.com. Company.com currently makes use of a computer named -sr01 which runs windows server 2008. during the course of the business day you receive instruction from Company.com to write an i/o dispatch routine for a windows device driver. the i/o dispatch routine written for the driver supports buffered i/o and transfers1-kb from the i/o request packet (irp). Company.com wants you to have the kernel address of the 1-kb buffer of the i/o request packet (irp) retrieved. what should you do?

You work a windows developer at Company.com. the Company.com network consists of a single active directory domain named Company.com. Company.com currently makes use of a computer named -sr01 which runs windows server 2008. during the course of the business day you receive instruction from Company.com to create a telecommunications application which requires having the application read the i/o synchronously. Company.com wants you to have the i/o operation initiated. what should you do?

You work a windows developer at Company.com. the Company.com network consists of a single active directory domain named Company.com. Company.com currently makes use of a computer named -sr01 which runs windows server 2008. during the course of the day you receive instruction from Company.com to make use of winddbg for debugging a windows server service which creates a thread named kingthreaD. Company.com additionally instructs you to determine the amount of cpu time consumed by kingthread. What should you do?

You work a windows developer at Company.com. the Company.com network consists of a single active directory domain named Company.com. Company.com currently makes use of a computer named -sr01 which runs windows server 2008. Company.com currently makes use of a device drive which has a monitoring thread named monitor and three worker threads named kingwork1, kingwork2 and kingwork3. when any of the kingwork threads are not run at least once every seconds the
monitor thread calls kebugcheckex and generates a bug check and complete kernel crash dump which is shown below:
thread name state priority monitor running low_realtime_priority
kingwork1 ready low_realtime_priority
kingwork2 ready low_realtime_priority
kingwork3 ready low-priority
Company.com additionally wants you to have the root cause of the bug check identified. What should you do?

You work a windows developer at the london office of Company.com. the Company.com network consists of a single active directory domain named Company.com. Company.com currently makes use of a computer named -sr01 which runs windows server 2008. during the course of the day you travel to the miami office and deploy an additional server named -sr02 which runs Microsoft windows server 2003. Company.com recently requested that you create a device driver for a pci device. whilst testing the device drivers interrupt processing the server stops responding. Company.com wants you to locate the interrupt handling routines in the crash dump. What should you do?

You are the IT professional who work in an International company named Wiikigo. You are experienced in troubleshooting operating systems and applications that are not working correctly, identifying code defects and so on. You have enough knowledge on windows internals and you provide technical support for the company. There is a computer named c01. Windows Server 2008 is run by C01. Now you are using WinDbg to debug C01. You find that one thread is waiting for a critical section. This section is owned by another thread. You have to locate the critical section. Of the following WinDbg commands, which one should be used?

You are the IT professional who work in an International company named Wiikigo. You are experienced in troubleshooting operating systems and applications that are not working correctly, identifying code defects and so on. You have enough knowledge on windows internals and you provide technical support for the company. There is a colleague named Jason in the company. He has a computer named C01. C01 runs Windows Vista. He finds that a service process is using 100 percent of the processor. He has to force a process dump of the service, meanwhile the service is consuming 100 percent of the processor. He has no idea about which tool he should use. Since you are the technical support, he asks for your answer. So which of the following tools should be used?

You are the IT professional who work in an International company named Wiikigo. You are experienced in troubleshooting operating systems and applications that are not working correctly, identifying code defects and so on. You have enough knowledge on windows internals and you provide technical support for the company. According to the company requirement, an I/O dispatch routine is being written by you for a Windows device driver. buffered I/O is supported by the device driver. 1 KB of data to the user process is transferred by the dispatch routine. The kernel address of the 1-KB buffer needs to be retrieved from the I/O request packet (IRP). Which field of the IRP contains the kernel address?

You are the IT professional who work in an International company named Wiikigo. You are experienced in troubleshooting operating systems and applications that are not working correctly, identifying code defects and so on. You have enough knowledge on windows internals and you provide technical support for the company. You are in charge of a multithreaded application. Now is being tested by you. You have to use Perfmon to test the application for heap leaks. Of the following counters, which one should be monitored?