(Ex:350-001):

1.You are developing a user mode application that contains two processes.
You need to allow the two processes to synchronize access to a shared data area.
Which synchronization primitive should you use?
A. Critical Section
B. ERESOURCE
C. Mutex
D. Spinlock
Answer: C

3. You have a device driver that has one monitoring thread named Thread1. The device driver has three worker threads named Thread2, Thread3, and Thread4. The worker threads run every 10 seconds and complete within 1 second. If any worker thread does not run at least once every 30 seconds, Thread1 calls KeBugCheckEx, and then a complete kernel crash dump is generated.
The computer generates a bug check and a complete kernel dump is generated.
You review the complete kernel dump and notice the following:
You need to identify the root cause of the bug check.
What caused the bug check to occur?
A. the priority of Thread1
B. the priority of Thread4
C. the state of Thread1
D. the state of Thread2 and Thread3
Answer: B

4. You develop a device driver for a PCI device. The PCI device runs on Windows Server 2003 computers.
You test the device driver's interrupt processing. The computer stops responding.
You need to locate the list of interrupt handling routines in the crash dump by using WinDbg.
Which command should you use?
A. !idt
B. !ipi
C. !irql
D. !isr
Answer: A

5. You develop a device driver for Windows XP that runs on uniprocessor systems only. The driver creates a system thread and a deferred procedure call (DPC). The DPC is invoked by a repeating timer.
The thread and the DPC must process entries from the same work queue.
You need to ensure that the system thread and the DPC are synchronized.
Which IRQ Level (IRQL) should you use?
A. APC_LEVEL
B. DISPATCH_LEVEL
C. LOW_LEVEL
D. PASSIVE_LEVEL
Answer: B

6. You develop a Windows device driver for a hardware device. The hardware device uses a simple direct memory access (DMA) controller. The hardware device does not perform virtual address translation.
You need to allocate a 64-KB buffer in Windows that accepts a DMA transfer of 64 KB from the hardware device.
Which routine should you use?
A. AllocateHeap(655536)
B. ExAllocatePoolWithTag(PagePool, 65536, 'abcd')
C. ExAllocatePoolWithTag(NonPagePool, 65536, 'abcd')
D. MmAllocateContiguousMemory(65536, 0xFFFFFFFF)
Answer: D

7. You are writing an I/O dispatch routine for a Windows device driver. The device driver supports buffered I/O. The dispatch routine transfers 1 KB of data to the user process.
You need to retrieve the kernel address of the 1-KB buffer from the I/O request packet (IRP).
Which field of the IRP contains the kernel address?
A. Irp->AssociatedIrp.SystemBuffer
B. Irp->Overlay.UserApcContext
C. Irp->Tail.Overlay.DriverContext[0]
D. Irp->UserBuffer
Answer: A

8. You plan to update a device driver on a Windows system. You download a copy of the device driver file from the Internet, but you are uncertain that the device driver is legitimate.
You need to verify the device driver's digital signature.
Which tool should you use?
A. Certmgr.exe
B. Certmgr.msc
C. Makecert.exe
D. Signtool.exe
Answer: D

2. You are developing an application.
You need to ensure that the application can read from COM port 10 by using the CreateFile function.
Which device name should you open?
A. "COM10"
B. "%COM10%"
C. "\COM10"
D. "\\.\COM10"
Answer: D