Operating Systems practice questions

Enable Data Execution Prevention (DEP) in Windows.

Why it fails: DEP is a security feature that prevents code execution in non-executable memory regions. It is unrelated to hardware virtualization support. Enabling DEP will not make the application detect virtualization capabilities and does not affect the firmware setting needed.

Disable Hyper-V in Windows Features.

Why it fails: Disabling Hyper-V is not required and may break other virtualization-based features. The application likely needs virtualization enabled, not disabled. Turning off Hyper-V would not enable CPU virtualization extensions in firmware and could remove functionality the user relies on.

Install the latest chipset drivers from the motherboard vendor.

Why it fails: Chipset drivers are important for system stability and device communication, but they do not enable CPU virtualization extensions. The firmware setting is the primary control. Installing drivers will not change the virtualization state and is not a required step for this scenario.

Task Manager > Performance tab

Why it fails: The Performance tab shows overall memory usage and can hint at paging, but it does not display page file usage or hard fault rates in detail. It is a quick overview, not a diagnostic tool for confirming excessive paging. Using it alone might not provide the specific evidence required to attribute slowness to insufficient RAM.

Device Manager

Why it fails: Device Manager is used to manage hardware devices and drivers. It does not provide performance metrics related to memory or paging. Checking Device Manager would not help determine whether the system is paging excessively due to insufficient RAM.

Resource Monitor

Why it fails: Resource Monitor provides detailed real-time CPU, disk, network, and memory usage, including hard faults per second, which can indicate paging. However, for a quick determination of whether insufficient RAM is causing excessive paging, Performance Monitor with specific counters is more direct. Resource Monitor is useful but not the primary tool for this specific diagnosis.

No, instead you should disable Windows Search to resolve the high CPU usage.

Why it fails: Windows Search is a different service that indexes files. Disabling it would not address SysMain's high CPU usage. While Windows Search can also cause high disk usage, the scenario specifically mentions SysMain. Therefore, this advice is irrelevant and does not solve the problem.

No, SysMain is essential for system stability and should never be disabled.

Why it fails: SysMain is not essential for system stability. It is a performance optimization service. While it is generally recommended to leave it enabled, it can be disabled if it causes issues, though that is not the best first step. Saying it should never be disabled is too absolute and incorrect.

Yes, disable SysMain because it is a legacy service that is not needed on modern systems.

Why it fails: SysMain (formerly Superfetch) is not legacy; it is designed to improve performance by preloading frequently used applications into RAM. Disabling it may reduce disk usage but can also slow down application launches. It is not recommended to disable it without a specific reason, and it is not a legacy service on Windows 11.

Point and Print Restrictions

Why it fails: Point and Print Restrictions is a policy that controls which drivers users can install from a print server, often used to enhance security. It does not facilitate automatic driver installation; instead, it can restrict it. Enabling this policy would likely hinder the goal of automatic installation, making it an incorrect choice for the scenario.

Network discovery

Why it fails: Network discovery allows a computer to see other devices on the network, which is necessary for finding shared resources. However, it does not by itself enable automatic driver installation for shared printers. The technician also needs to enable printer sharing and, more specifically, the feature that allows clients to download drivers. Network discovery is a prerequisite but not the complete solution for driverless installation.

File and printer sharing

Why it fails: File and printer sharing enables the workstation to share its printer over the network, but it does not automatically provide drivers to client computers. Clients may still need to supply their own drivers or prompt the user for installation. While essential for sharing the printer, this feature alone does not meet the requirement for automatic driver installation on other Windows 11 computers.

System Configuration (msconfig) > Services tab

Why it fails: The Services tab in msconfig shows Windows services, not user-level startup programs. Many startup apps are not services and would be missed. While it can help with service-related delays, it is not the first tool to identify a specific startup application causing high disk usage after sign-in.

Event Viewer > Windows Logs > Application

Why it fails: The Application log may show errors from crashing apps, but the scenario reports no error messages. It does not enumerate startup programs or show which one is consuming disk during logon. Searching this log first would likely yield no actionable entries and delay resolution.

Performance Monitor with a Data Collector Set

Why it fails: Performance Monitor can capture detailed disk and CPU counters, but it does not list startup programs or their impact ratings. Using it first would require you to manually correlate hundreds of counters to a specific app, which is inefficient when Task Manager already surfaces startup impact. It is better for ongoing baseline monitoring, not quick startup triage.

Disk Management's Extend Volume on the new disk after cloning

Why it fails: Extend Volume only appends unallocated space to an existing partition on a disk that already contains the operating system data. A brand-new NVMe drive has no operating system partition to extend, so this action cannot migrate the installation. Extending is a post-migration step for reclaiming leftover space, not the mechanism that copies Windows and applications.

Windows System Image Backup (wbadmin) restore to the new disk

Why it fails: System Image Backup captures full volumes and restores them, but restoring an image to a different-sized NVMe disk often fails to boot because the partition layout and boot configuration are recreated rather than adjusted. It also does not resize the system partition automatically, so it is a poor fit for a same-system drive upgrade where applications and profiles must remain intact.

Windows Recovery Environment's Reset this PC with Keep my files

Why it fails: Reset this PC reinstalls Windows on the current drive and removes desktop applications even when user files are kept. It does not transfer the installation to a new disk, and the domain join would have to be recreated. This option addresses a corrupted OS on the same hardware, not a hardware migration to a larger NVMe device.

bootrec /fixboot

Why it fails: bootrec /fixboot writes a new boot sector to the system partition. It does not rebuild the BCD. It is used when the boot sector is corrupted or missing, but it does not address BCD corruption. Thus, it is not a correct answer for rebuilding the BCD.

bootrec /fixmbr

Why it fails: bootrec /fixmbr writes a new master boot record to the system partition. It repairs the MBR but does not touch the BCD. It is used for MBR corruption, not BCD issues. Therefore, it is not a correct answer for rebuilding the BCD.

bcdedit /export

Why it fails: bcdedit /export backs up the BCD store to a file. It does not rebuild or repair the BCD. While it is useful for backup before making changes, it does not resolve a corrupted BCD. Therefore, it is not a correct answer for rebuilding.

bootrec /fixmbr

Why it fails: The /fixmbr switch writes a new master boot record to the system partition, which is useful when the MBR is corrupted on a BIOS/MBR system. However, this laptop is Windows 11 and likely uses UEFI with GPT, and the error points to missing boot configuration data rather than a damaged MBR. Running /fixmbr alone will not rebuild the BCD store or resolve the "Bootmgr is missing" message.

chkdsk /f

Why it fails: chkdsk /f repairs file system errors and bad sectors on a volume, which can resolve some boot failures caused by disk corruption. However, the specific error "Bootmgr is missing" indicates a missing or damaged boot configuration entry, not a file system integrity problem. Running chkdsk alone will not recreate the BCD entry that the boot manager needs to locate the Windows installation.

sfc /scannow

Why it fails: System File Checker scans and repairs protected Windows system files, but it requires a running Windows environment to operate effectively. From the Windows Recovery Environment, sfc can be run offline against an installation, yet it does not rebuild the Boot Configuration Data store. The "Bootmgr is missing" error occurs before Windows loads, so repairing system files will not restore the boot entry.

chkdsk C: /f /r

Why it fails: chkdsk repairs file system errors and recovers readable data from bad sectors, which helps when corruption prevents booting. However, a missing operating system message caused by a lost boot entry is not a file system problem, so chkdsk will not recreate the Boot Configuration Data. It is useful after boot repair if disk errors are also suspected.

sfc /scannow

Why it fails: System File Checker verifies and repairs protected Windows system files, but it requires a running or at least mounted Windows installation and does not rebuild boot entries. When the operating system cannot be found, the boot manager never loads, so sfc /scannow cannot resolve the missing boot configuration and may report that it cannot perform the repair.

bootrec /fixmbr

Why it fails: bootrec /fixmbr writes a standard master boot record to the system partition, which addresses MBR corruption on legacy BIOS systems. On a UEFI Windows 11 laptop using GPT, the MBR is not the boot path, so this command does nothing useful for a missing operating system message and may leave the actual EFI boot entries unrepaired.

Install Windows manually on each PC, then run a PowerShell script to remove applications

Why it fails: A post-install script can remove provisioned applications, but manually installing Windows on 40 machines is labor-intensive and error-prone, and it does not guarantee a consistent driver set or Start layout unless additional configuration is layered on. This approach also leaves each machine's image slightly different, undermining standardization.

Perform an in-place upgrade on each workstation using a mounted ISO

Why it fails: An in-place upgrade preserves existing settings and applications rather than applying a standardized configuration to blank hardware. Running it on 40 new workstations would require installing Windows first and then upgrading, which is redundant and does not strip built-in consumer applications in a controlled way. It also cannot enforce a common Start layout across all machines.

Use Windows Backup to restore a reference workstation's files to each new PC

Why it fails: Windows Backup copies user files and some settings but does not transfer the operating system, installed applications, or driver set. Restoring files to a bare workstation leaves no bootable Windows installation, and the built-in consumer applications would remain or be absent depending on what was originally installed. It cannot enforce a consistent Start layout across the fleet.

Storage Spaces

Why it fails: Storage Spaces pools physical disks to create virtual disks with resiliency and capacity benefits, but it does not provide per-user storage limits. It is designed for flexible storage configuration and fault tolerance rather than user-level quotas. Applying Storage Spaces would not restrict an individual user's profile size, so it fails to satisfy the requirement for a 500 MB per-user limit.

Folder Redirection

Why it fails: Folder Redirection moves known folders such as Documents and Desktop to a network share, which centralizes data but does not enforce a per-user disk quota. It is typically used in domain environments to simplify backups and roaming profiles. Because the scenario requires limiting local disk space per user profile, Folder Redirection does not provide the quota enforcement needed and would not restrict how much data a user can store locally.

User Account Control

Why it fails: User Account Control (UAC) prompts for elevation when administrative tasks are attempted, helping prevent unauthorized system changes. It has no role in measuring or limiting disk space consumption by user profiles. Enabling or configuring UAC would not impose any storage cap, so it cannot fulfill the requirement to limit each user's profile to 500 MB.

Disk queue length

Why it fails: Disk queue length indicates the number of I/O requests waiting for the disk, which can rise when heavy paging occurs due to low memory. It is a secondary symptom rather than a direct measure of memory exhaustion. The technician needs to confirm the memory leak itself, so disk queue length is less direct than monitoring memory usage and available memory. It may be elevated but does not prove the leak.

CPU utilization

Why it fails: CPU utilization shows the percentage of processor capacity being used, which can reveal high load from a runaway process. However, a memory leak may not cause sustained high CPU usage; the system could slow down due to paging while CPU remains moderate. While useful, this counter alone does not confirm memory exhaustion, so it is not one of the two best indicators for the suspected leak.

GPU usage

Why it fails: GPU usage measures the load on the graphics processor, which is relevant for graphics-intensive tasks but not for diagnosing a memory leak. A memory leak in a user-mode process would not necessarily increase GPU utilization. Monitoring GPU usage would not provide evidence of system memory exhaustion, so it is not an appropriate counter for this scenario.

Reliability Monitor

Why it fails: Reliability Monitor aggregates stability events, application failures, and Windows updates into a timeline and can show that a driver update coincides with crashes. However, it reports the event and the update name rather than the specific driver file or module that caused the fault, so it helps correlate timing but does not directly identify the offending driver in the crash.

Event Viewer's System log

Why it fails: The System log records the bug check code and sometimes the dump file path, but it rarely names the individual driver responsible. It confirms that a crash occurred and when, which is useful context, yet it does not provide the module-level detail needed to pin the fault on a specific driver, so it is supplementary rather than definitive.

Performance Monitor's counter logs

Why it fails: Performance Monitor tracks resource counters such as CPU, memory, disk, and network utilization over time. It can reveal resource exhaustion preceding a freeze but has no visibility into kernel driver call stacks or bug check analysis, so it cannot name the driver that triggered the IRQL fault. It is a capacity and trend tool, not a crash diagnostic.

The user does not have administrative privileges.

Why it fails: Lack of administrative privileges would typically result in an access denied error or a prompt for credentials, not error 0x800F0906. The technician likely has admin rights, as they are attempting to enable a Windows feature. Thus, this is not the most likely cause.

The .NET Framework 3.5 feature is corrupted in the Windows component store.

Why it fails: While component store corruption can cause feature installation failures, error 0x800F0906 specifically points to a missing source or inability to download. Corruption would more likely produce error 0x800F081F or similar. The most common cause is lack of internet or blocked Windows Update. Therefore, this is not the primary cause.

The application is not compatible with Windows 11.

Why it fails: The error is specific to enabling .NET Framework 3.5, not application compatibility. .NET Framework 3.5 is supported on Windows 11, but it is not installed by default. The error occurs during the enabling process, not because the application is incompatible. Therefore, this is not the cause.

systemctl get-default, then systemctl set-default graphical.target

Why it fails: systemctl get-default reports the default target that will be used on the next boot, and set-default changes it persistently. Neither command changes the currently running target, so the user would still be at the command line until a reboot. The scenario requires an immediate switch in the running session, which this pair does not provide.

systemctl isolate multi-user.target, then reboot

Why it fails: Isolating multi-user.target stops the graphical environment and leaves the system in a text-only state, which is the opposite of the goal. Rebooting afterward returns the system to whatever default target is configured, so this sequence neither diagnoses the current state nor restores the desktop in the running session.

systemctl status graphical.target, then systemctl restart gdm

Why it fails: Checking the status of graphical.target shows whether it is active or inactive, which is useful information, but restarting the display manager does not start the graphical target if it was never activated. If the system booted to multi-user.target, gdm may not be enabled, so restarting it fails or exits immediately, leaving the user at the command line.

Task Manager

Why it fails: Task Manager shows running processes, performance counters, and startup items, but it does not provide detailed driver information or error codes for hardware devices. It cannot verify the display adapter driver version or indicate driver conflicts. While useful for monitoring resource usage, it is not the appropriate tool for diagnosing a suspected driver issue with the display.

Disk Management

Why it fails: Disk Management is used to manage disk partitions, volumes, and drive letters. It has no functionality related to display adapters or their drivers. The technician would not find driver version details or error status for the graphics hardware in this console. Therefore, it cannot help resolve the dim display issue.

System Configuration

Why it fails: System Configuration (msconfig) is used to manage startup options, services, and boot parameters. It does not display driver versions or hardware error codes for the display adapter. While it can be used to troubleshoot boot issues, it is not designed for driver verification. The technician needs a tool that specifically lists devices and drivers, which System Configuration does not provide.