Computer Hacking Forensic Investigator (CHFI) — Question 19
What file is processed at the end of a Windows XP boot to initialize the logon dialog box?
Answer options
- A. NTOSKRNL.EXE
- B. NTLDR
- C. LSASS.EXE
- D. NTDETECT.COM
Correct answer: A
Explanation
The correct answer is NTOSKRNL.EXE, as it is the Windows kernel that is responsible for managing system processes and initializing the logon dialog. NTLDR is the boot loader for Windows, LSASS.EXE is responsible for security policy enforcement, and NTDETECT.COM is used for detecting hardware during boot, but none of these directly initialize the logon process.