Computer Hacking Forensic Investigator (CHFI v10) — Question 3

What file is processed at the end of a Windows XP boot to initialize the logon dialog box?

Answer options

• A. NTOSKRNL.EXE
• B. NTLDR
• C. LSASS.EXE
• D. NTDETECT.COM

Correct answer: A

Explanation

The correct answer is NTOSKRNL.EXE, as it is the Windows NT operating system kernel that is responsible for system initialization and ultimately presents the logon dialog. NTLDR is the boot loader for Windows NT, LSASS.EXE is responsible for security policy and user authentication, and NTDETECT.COM is used for detecting hardware during the boot process, none of which directly initialize the logon dialog.