Welcome to the Windows Fundamentals MCQs Page

Dive deep into the fascinating world of Windows Fundamentals with our comprehensive set of Multiple-Choice Questions (MCQs). This page is dedicated to exploring the fundamental concepts and intricacies of Windows Fundamentals, a crucial aspect of Reverse Engineering. In this section, you will encounter a diverse range of MCQs that cover various aspects of Windows Fundamentals, from the basic principles to advanced topics. Each question is thoughtfully crafted to challenge your knowledge and deepen your understanding of this critical subcategory within Reverse Engineering.

Check out the MCQs below to embark on an enriching journey through Windows Fundamentals. Test your knowledge, expand your horizons, and solidify your grasp on this vital area of Reverse Engineering.

Note: Each MCQ comes with multiple answer choices. Select the most appropriate option and test your understanding of Windows Fundamentals. You can click on an option to test your knowledge before viewing the solution for a MCQ. Happy learning!

Windows Fundamentals MCQs | Page 7 of 26

Explore more Topics under Reverse Engineering

01

Introduction to Reverse Engineering

02

Low Level Software 🔒

03

Reversing Tools 🔒

04

Beyond the Documentation

05

Deciphering File Formats

06

Auditing Program Binaries 🔒

07

Reversing Malware 🔒

08

Piracy and Copy Protection

09

Antireversing Techniques 🔒

10

Breaking Protections 🔒

11

Reversing .NET 🔒

12

Decompilation

13

Deciphering Code Structures 🔒

14

Understanding Compiled Arithmetic

15

Deciphering Program Data 🔒

Q61.

In Win32, what are section objects called?

Kernel memory spaces

Memory management units

Virtual memory ranges

Memory mapped files

Discuss

Answer: (d).Memory mapped files Explanation:In Win32 (and in most of Microsoft's documentation), section objects are called memory mapped files.

Q62.

What is a section object in Windows memory manager?

A chunk of memory managed by the operating system

A tool used by applications to share memory

A kernel concept used for sharing memory between user-mode processes and the kernel

A virtual address range allocated for accessing memory

Discuss

Answer: (a).A chunk of memory managed by the operating system Explanation:A section object is a special chunk of memory that is managed by the operating system.

Q63.

How can section objects be mapped?

By attaching to a physical file on the hard drive

By creating a temporary storage space

By allocating a virtual address range

By using APIs such as ReadFile and WriteFile

Discuss

Answer: (c).By allocating a virtual address range Explanation:Mapping a section object means that a virtual address range is allocated for the object and it then becomes accessible through that address range.

Q64.

What is the purpose of a pagefile-backed section object?

To share data between two processes or between applications and the kernel

To access a file directly in memory using a pointer

To load executable images

To provide temporary storage for data that can be paged out to a pagefile if required

Discuss

Answer: (d).To provide temporary storage for data that can be paged out to a pagefile if required Explanation:A pagefile-backed section object can be used for temporary storage of information and is usually created for the purpose of sharing data between two processes or between applications and the kernel. The section is created empty, and can be mapped to any address space (both in user memory and in kernel memory). Just like any other paged memory region, a pagefile-backed section can be paged out to a pagefile if required.

Q65.

What is a file-backed section object?

A section object created for the purpose of sharing data between two processes or between applications and the kernel

A section object attached to a physical file on the hard drive

A section object used to load executable images

A section object used for temporary storage of information

Discuss

Answer: (b).A section object attached to a physical file on the hard drive Explanation:A file-backed section object is attached to a physical file on the hard drive. This means that when it is first mapped, it will contain the contents of the file to which it is attached. If it is writable, any changes made to the data while the object is mapped into memory will be written back into the file. A file-backed section object is a convenient way of accessing a file, because instead of using cumbersome APIs such as ReadFile and WriteFile, a program can just directly access the data in memory using a pointer. The system uses file-backed section objects for a variety of purposes, including the loading of executable images.

Q66.

Can section objects be mapped to more than one place?

Yes

May be Yes or No

Can't say

Discuss

Answer: (a).Yes Explanation:One of the key properties of section objects is that they can be mapped to more than one place. This makes section objects a convenient tool for applications to share memory between them. The system also uses section objects to share memory between the kernel and user-mode processes.

Q67.

What is a Virtual Address Descriptor (VAD) tree?

A data structure used by Windows for managing each individual process’s address allocation

A binary tree used by Windows for file management

A tool used for mapping virtual addresses to physical addresses

A Windows service used for virtualization

Discuss

Answer: (a).A data structure used by Windows for managing each individual process’s address allocation Explanation:The VAD tree is a binary tree that describes every address range that is currently in use. Each process has its own individual tree, and within those trees each entry describes the memory allocation in question.

Q68.

What are the two distinct kinds of allocations managed by VAD trees?

Mapped allocations and private allocations

Public allocations and private allocations

File-backed allocations and temporary allocations

Executable allocations and stack allocations

Discuss

Answer: (a).Mapped allocations and private allocations Explanation:Mapped allocations are memory-mapped files that are mapped into the address space. This includes all executables loaded into the process address space and every memory-mapped file (section object) mapped into the address space. Private allocations are allocations that are process private and were allocated locally.

Q69.

What is the purpose of private allocations in VAD trees?

To manage memory-mapped files

To manage executable images

To manage process private and locally allocated memory

To manage system-wide physical memory

Discuss

Answer: (c).To manage process private and locally allocated memory Explanation:Private allocations are typically used for heaps and stacks (there can be multiple stacks in a single process—one for each thread).

Q70.

What are private allocations in a process?

Memory-mapped files mapped into the address space

Memory blocks allocated using the VirtualAlloc API

Multiple variable-sized blocks of memory within a larger block

Automatic allocation of a stack for every thread

Discuss

Answer: (b).Memory blocks allocated using the VirtualAlloc API Explanation:Private allocations are the most basic type of memory allocation in a process, where an application requests a memory block using the VirtualAlloc Win32 API.

Page 7 of 26

Low Level Software 🔒

Reversing Tools 🔒

Auditing Program Binaries 🔒

Reversing Malware 🔒

Antireversing Techniques 🔒

Breaking Protections 🔒

Reversing .NET 🔒

Deciphering Code Structures 🔒

Deciphering Program Data 🔒

Welcome to the Windows Fundamentals MCQs Page

Windows Fundamentals MCQs | Page 7 of 26

Explore more Topics under Reverse Engineering

Introduction to Reverse Engineering

Beyond the Documentation

Deciphering File Formats

Piracy and Copy Protection

Decompilation

Understanding Compiled Arithmetic

Suggested Topics

UNIX

Visual Basic

Hadoop

Embedded Systems

Object Oriented Programming Using C++

Data Warehousing and OLAP

Microprocessor

CSS

MongoDB