Skip to main content

Revision MCQ - Operating Systems

Instructions​

  • 50 questions covering the entire course
  • Record your answers on a sheet
  • Check with the answers at the end
  • Goal: Minimum 80% correct answers

Section 1: Architecture and Configuration (Q1-10)​

Q1. Which component manages the translation of virtual addresses to physical addresses?​

  • A) CPU
  • B) RAM
  • C) MMU (Memory Management Unit)
  • D) Hard drive

Q2. What is the default size of a memory page in Windows?​

  • A) 1 KB
  • B) 4 KB
  • C) 64 KB
  • D) 1 MB

Q3. The BIOS/UEFI is stored in:​

  • A) The hard drive
  • B) The RAM
  • C) A flash memory on the motherboard
  • D) The CPU

Q4. Secure Boot prevents:​

  • A) Access to the BIOS
  • B) Booting of unsigned code
  • C) Installation of Windows
  • D) Network connection

Q5. Which protocol allows remote management of the BIOS on servers?​

  • A) SSH
  • B) RDP
  • C) IPMI/BMC
  • D) Telnet

Q6. A system environment variable is accessible by:​

  • A) A single user
  • B) All users
  • C) Only the administrator
  • D) Only services

Q7. To view all environment variables in PowerShell:​

  • A) env
  • B) Get-ChildItem Env:
  • C) $PATH
  • D) echo %PATH%

Q8. The TPM (Trusted Platform Module) is used for:​

  • A) Accelerating the CPU
  • B) Storing cryptographic keys
  • C) Increasing RAM
  • D) Managing the network

Q9. The IP address 127.0.0.1 represents:​

  • A) The default router
  • B) The broadcast address
  • C) The local loopback interface
  • D) The DNS server

Q10. The command ipconfig /all displays:​

  • A) Only the IP
  • B) The complete network configuration
  • C) The routes
  • D) The active connections

Section 2: File System (Q11-20)​

Q11. NTFS stands for:​

  • A) New Technology File System
  • B) Network Transfer File System
  • C) Next Technology File System
  • D) Normal Text File System

Q12. What is the maximum file size on NTFS?​

  • A) 4 GB
  • B) 2 TB
  • C) 16 EB (theoretical)
  • D) 256 GB

Q13. ACLs (Access Control Lists) allow:​

  • A) Encrypting files
  • B) Defining granular permissions
  • C) Compressing files
  • D) Defragmenting the disk

Q14. An Alternate Data Stream (ADS) is:​

  • A) A video stream
  • B) Hidden data attached to a file
  • C) A network connection
  • D) A type of compression

Q15. To list the ADS of a file:​

  • A) dir /s
  • B) Get-Item file -Stream *
  • C) type file
  • D) more file

Q16. The NTFS journal ($LogFile) is used to:​

  • A) Record connections
  • B) Recover after a crash
  • C) Store passwords
  • D) Compress files

Q17. Shadow Copy allows:​

  • A) Copying files
  • B) Restoring previous versions
  • C) Deleting files
  • D) Encrypting files

Q18. The MFT (Master File Table) contains:​

  • A) Installed programs
  • B) Metadata of all files
  • C) The operating system
  • D) Drivers

Q19. ReFS is optimized for:​

  • A) USB keys
  • B) Data volumes and resilience
  • C) Fast boot
  • D) DOS compatibility

Q20. EFS (Encrypting File System) protects files:​

  • A) At the entire disk level
  • B) At the individual file level
  • C) At the network level
  • D) At the BIOS level

Section 3: Windows Security (Q21-30)​

Q21. UAC (User Account Control) is used to:​

  • A) Manage users
  • B) Request confirmation for elevated actions
  • C) Encrypt files
  • D) Configure the firewall

Q22. LSASS (Local Security Authority Subsystem Service) manages:​

  • A) The firewall
  • B) Authentication and tokens
  • C) Updates
  • D) Printing

Q23. An access token contains:​

  • A) The user's password
  • B) The user's SIDs and privileges
  • C) The IP address
  • D) The list of files

Q24. SeImpersonatePrivilege allows:​

  • A) Deleting files
  • B) Acting on behalf of another user
  • C) Modifying the registry
  • D) Shutting down the system

Q25. Windows Defender Credential Guard protects:​

  • A) Files
  • B) Credentials in memory via virtualization
  • C) The firewall
  • D) Updates

Q26. A reverse shell connects:​

  • A) From the attacker to the target
  • B) From the target to the attacker
  • C) Between two servers
  • D) To the DNS

Q27. Mimikatz is used to:​

  • A) Create users
  • B) Extract credentials from memory
  • C) Scan the network
  • D) Configure the firewall

Q28. Pass-the-Hash allows authentication with:​

  • A) The plaintext password
  • B) The NTLM hash without knowing the password
  • C) A USB key
  • D) A certificate

Q29. To temporarily disable Windows Defender (admin):​

  • A) Stop-Service Defender
  • B) Set-MpPreference -DisableRealtimeMonitoring $true
  • C) Disable-WindowsDefender
  • D) defender -off

Q30. WDigest stored passwords in plaintext until:​

  • A) Windows XP
  • B) Windows 7
  • C) Windows 8.1 (fixed by update)
  • D) Windows 11

Section 4: PowerShell (Q31-40)​

Q31. To get help on a command:​

  • A) help command
  • B) Get-Help command
  • C) man command
  • D) All answers

Q32. The pipeline (|) in PowerShell:​

  • A) Executes commands in parallel
  • B) Passes objects from one command to another
  • C) Creates a file
  • D) Comments the code

Q33. To filter objects:​

  • A) Select-Object
  • B) Where-Object
  • C) Filter-Object
  • D) Find-Object

Q34. $_ represents:​

  • A) The last result
  • B) The current object in the pipeline
  • C) An error
  • D) The current path

Q35. To run an unsigned script:​

  • A) Set-ExecutionPolicy Bypass
  • B) Enable-Scripts
  • C) Allow-Execution
  • D) Run-Script

Q36. AMSI (Antimalware Scan Interface) allows:​

  • A) Scanning disks
  • B) Inspecting script content before execution
  • C) Blocking the network
  • D) Encrypting files

Q37. To create a scheduled task in PowerShell:​

  • A) New-Task
  • B) Register-ScheduledTask
  • C) Create-Schedule
  • D) Add-Job

Q38. PowerShell aliases allow:​

  • A) Creating users
  • B) Using shortcuts for commands
  • C) Encrypting files
  • D) Connecting remotely

Q39. Get-Process | Stop-Process will:​

  • A) List processes
  • B) Stop all processes (DANGEROUS!)
  • C) Create processes
  • D) Do nothing

Q40. To see running services:​

  • A) Get-Service
  • B) Get-Service | Where-Object {$_.Status -eq "Running"}
  • C) services.msc
  • D) B and C are correct

Section 5: IPC and Memory (Q41-50)​

Q41. IPC stands for:​

  • A) Internet Protocol Communication
  • B) Inter-Process Communication
  • C) Internal Process Control
  • D) Input Process Command

Q42. A Named Pipe allows communication:​

  • A) Locally only
  • B) Locally and over the network
  • C) On the network only
  • D) Between CPU and RAM

Q43. The format of a local named pipe is:​

  • A) //./pipe/name
  • B) \\.\pipe\name
  • C) /pipe/name
  • D) pipe://name

Q44. "Potato" attacks exploit:​

  • A) Web vulnerabilities
  • B) Token impersonation via IPC
  • C) DNS flaws
  • D) Encryption

Q45. A process's Working Set represents:​

  • A) The CPU used
  • B) The memory currently in RAM
  • C) Disk space
  • D) Network connections

Q46. Private Bytes represents:​

  • A) Shared memory
  • B) Memory exclusive to the process
  • C) Cache
  • D) Page file

Q47. The Page File (pagefile.sys) is used to:​

  • A) Store programs
  • B) Extend virtual memory on the disk
  • C) Backup files
  • D) Speed up boot

Q48. A Mutex allows:​

  • A) Network communication
  • B) Mutual exclusion between processes
  • C) Encryption
  • D) Compression

Q49. DCOM (Distributed COM) allows:​

  • A) COM communication over the network
  • B) File storage
  • C) Encryption
  • D) Printing

Q50. WMI (Windows Management Instrumentation) is used for:​

  • A) Graphics
  • B) System administration and queries
  • C) Sound
  • D) Games

Answers​

Click to see the answers

Section 1​

  1. C - MMU
  2. B - 4 KB
  3. C - Flash memory
  4. B - Booting of unsigned code
  5. C - IPMI/BMC
  6. B - All users
  7. B - Get-ChildItem Env:
  8. B - Storing cryptographic keys
  9. C - The local loopback interface
  10. B - The complete network configuration

Section 2​

  1. A - New Technology File System
  2. C - 16 EB (theoretical)
  3. B - Defining granular permissions
  4. B - Hidden data attached to a file
  5. B - Get-Item file -Stream *
  6. B - Recover after a crash
  7. B - Restoring previous versions
  8. B - Metadata of all files
  9. B - Data volumes and resilience
  10. B - At the individual file level

Section 3​

  1. B - Request confirmation for elevated actions
  2. B - Authentication and tokens
  3. B - The user's SIDs and privileges
  4. B - Acting on behalf of another user
  5. B - Credentials in memory via virtualization
  6. B - From the target to the attacker
  7. B - Extract credentials from memory
  8. B - The NTLM hash without knowing the password
  9. B - Set-MpPreference -DisableRealtimeMonitoring $true
  10. C - Windows 8.1 (fixed by update)

Section 4​

  1. D - All answers
  2. B - Passes objects from one command to another
  3. B - Where-Object
  4. B - The current object in the pipeline
  5. A - Set-ExecutionPolicy Bypass
  6. B - Inspecting script content before execution
  7. B - Register-ScheduledTask
  8. B - Using shortcuts for commands
  9. B - Stop all processes (DANGEROUS!)
  10. D - B and C are correct

Section 5​

  1. B - Inter-Process Communication
  2. B - Locally and over the network
  3. B - \\.\pipe\name
  4. B - Token impersonation via IPC
  5. B - The memory currently in RAM
  6. B - Memory exclusive to the process
  7. B - Extend virtual memory on the disk
  8. B - Mutual exclusion between processes
  9. A - COM communication over the network
  10. B - System administration and queries

Interpretation of Results​

ScoreLevelRecommendation
90-100%ExcellentReady for the exam!
80-89%GoodReview weak points
70-79%AcceptableReview the relevant sections
Less than 70%InsufficientIn-depth study needed

Revision MCQ - Operating Systems Course