CCNA Windows Command Line Tools Questions

The tasklist command displays a list of running processes along with memory usage (in kilobytes) directly from the command prompt. It is a built-in Windows tool, so no extra software is needed. Other options either do not show process details or require additional tools.

The System File Checker (sfc /scannow) scans protected system files and replaces corrupted ones with cached copies. If the application relies on system files, sfc can fix the issue. DISM repairs the system image itself, chkdsk checks disk errors, and tasklist lists processes.

The correct answer is `bootrec /rebuildbcd`, which scans for Windows installations and rebuilds the BCD store. This is a standard repair for boot manager issues. Other commands are for disk checking, system file repair, or partition management.

The wevtutil command can query event logs using structured XML queries, allowing you to filter events by time and ID (e.g., 4720 for user creation). It is a powerful tool for log analysis. Other commands either display logs without filtering or manage disk partitions.

The netstat command with the -a (all connections) and -n (numerical addresses) options shows all listening ports and their associated processes. This is essential for security analysis. Other tools like nslookup resolve DNS, tracert trace routes, and ipconfig show IP configuration.

The ipconfig /release command releases the current DHCP lease, and ipconfig /renew requests a new IP address from the DHCP server. This is the standard troubleshooting sequence for IP configuration issues. Other commands either display information or flush DNS, which does not address the IP lease issue.

The ping -t command sends continuous ICMP echo requests until stopped, and appending > log.txt redirects output to a file. This allows for long-term monitoring of connectivity. Other commands either perform a single test or trace the route.

The netstat -b command displays active connections along with the executable involved in creating each connection, making it ideal for identifying suspicious processes. Other options either show process information without network details or vice versa.

The correct answer is `regsvr32` which is used to register or unregister DLL files. This command verifies that the necessary DLLs are properly registered, which is essential for application functionality. Incorrect answers involve network configuration, file system repair, or process listing.

The correct answer is `net use Z: \\Server\Data /persistent:yes`. This command maps the network drive and makes it persistent so it reconnects at logon. Other commands deal with user accounts, disk repair, or network configuration.

The correct answer is `chkdsk /r`, which locates bad sectors and attempts to recover readable data. `/f` only fixes file system errors, while `/scan` and `/spotfix` are used in newer versions for online repair. The `/r` option implies `/f` and does a thorough check.

The correct answer is `tracert`, which traces the route to a destination and shows each hop. This helps pinpoint where packets are being dropped. `ping` only tests reachability, `nslookup` resolves names, and `netstat` shows connections.

The net user command with the /delete switch removes a local user account. For example, 'net user UnauthorizedUser /delete' deletes the account. Other commands like net localgroup manage groups, wmic useraccount can also delete but net user is the standard CLI tool. gpresult shows group policy results.

The correct answer is `rstrui.exe`, which launches the System Restore wizard. This can revert system files and settings to a previous state. `vssadmin` manages shadow copies but does not directly restore, `wbadmin` is for backup and restore, and `bootrec` repairs boot issues.

The ipconfig /release command releases the current DHCP lease, and ipconfig /renew requests a new IP address from the DHCP server. This is the standard method to refresh IP configuration. Other commands like ping test connectivity, nslookup queries DNS, and netstat shows network connections.

The correct answer is `taskkill /IM malware.exe /F`. This forcefully terminates the process by image name. `tasklist` only lists processes, `net stop` stops services (not processes), and `shutdown` restarts the computer.

The net view command lists available shared resources on a specified server, allowing you to verify both network connectivity and share availability. It is a quick diagnostic tool for shared folder issues. Other commands either test basic connectivity or map drives but do not list shares.

The xcopy command with the /y switch suppresses the prompt to confirm overwriting, and /s copies directories and subdirectories (if needed). It is designed for file copying with advanced options like silent overwrite. Other commands either do not copy files or lack the silent overwrite feature.

The correct answer is `netsh interface ip set address "Local Area Connection" static 192.168.1.100 255.255.255.0 192.168.1.1 1`. This sets a static IP with the specified parameters. `ipconfig` is used for display, `netstat` for connections, and `ping` for testing.

The gpupdate /force command forces an immediate refresh of all group policy settings, including drive maps, without requiring a reboot. It is the standard tool for applying policy changes on Windows. Other commands either manage user accounts or network configurations.

The taskkill command can terminate processes by name or PID. The /F flag forces termination, which is necessary for stubborn malware. Other commands like tasklist list processes, shutdown reboots the system, and regedit edits the registry.

The bootrec /rebuildbcd command scans all drives for Windows installations and rebuilds the Boot Configuration Data store. This is the standard recovery command for missing or corrupt BCD. Other commands either fix the master boot record or system files, not the BCD specifically.

First, you must stop the Windows Update service using net stop wuauserv. Then, delete the contents of the SoftwareDistribution folder (e.g., del /f /s /q C:\Windows\SoftwareDistribution\*). Other commands like sfc repair system files, dism repair the image, and taskkill terminate processes but are not the correct sequence.

The bootrec tool is specifically designed to repair boot-related issues like a missing or corrupted Boot Manager. The /fixboot and /rebuildbcd options can resolve the 'Bootmgr is missing' error. Other tools like diskpart manage disks, sfc repairs system files, and chkdsk checks disk integrity.

The ipconfig /flushdns command clears the DNS resolver cache, which can resolve issues caused by stale or corrupted entries. Other commands like nslookup query DNS servers, netstat show connections, and ping test connectivity but do not clear the cache.

The correct answer is `msiexec /i update.msi /quiet /norestart`. This installs the MSI silently without prompting the user. `/passive` shows a progress bar, `/qb` shows a basic UI, and `/l*` creates a log file but does not suppress UI.

The tasklist command displays a list of running processes along with their PID, session name, and memory usage. This makes it the correct tool for identifying a memory-hungry process by name. Other options either do not show memory details or are used for different purposes like network configuration or disk management.

The correct answer is tasklist, which displays a list of running processes along with memory usage. You can sort the output by memory to quickly find the culprit. This is a fundamental command for identifying resource-hungry processes.

The runas command allows executing a program with different credentials, typically an administrator account. In deployment scripts, runas /user:Administrator ensures the script runs with elevated privileges. Other options like msiexec install MSI packages, wmic queries WMI, and schtasks schedules tasks.

The runas command allows you to run a program with different credentials, such as an administrator account, from the command line. It is the standard way to elevate privileges in a script. Other commands either manage user accounts or change directories.