GIAC Certified Forensic Analyst (GCFA) — Question 30

Which of the following is the correct order of loading system files into the main memory of the system, when the computer is running on Microsoft's Windows XP operating system?

Answer options

• A. NTLDR, BOOT.ini, HAL.dll, NTDETECT.com, NTOSKRNL.exe
• B. NTLDR, BOOT.ini, NTDETECT.com, HAL.dll, NTOSKRNL.exe
• C. NTLDR, BOOT.ini, HAL.dll, NTDETECT.com, NTOSKRNL.exe
• D. BOOT.ini, HAL.dll, NTDETECT.com, NTLDR, NTOSKRNL.exe

Correct answer: B

Explanation

The correct sequence starts with NTLDR, which loads the BOOT.ini file to determine the operating system options. Following that, NTDETECT.com is called to detect the hardware configuration before HAL.dll and NTOSKRNL.exe are loaded. Options A, C, and D do not follow this correct order, which is why they are incorrect.