GIAC Certified Forensic Analyst (GCFA) — Question 43

Which of the following Windows XP system files handles memory management, I/O operations, and interrupts?

Answer options

• A. Ntoskrnl.exe
• B. Win32k.sys
• C. Advapi32.dll
• D. Kernel32.dll

Correct answer: D

Explanation

The correct answer, Kernel32.dll, is crucial for memory management and I/O operations in Windows XP. Ntoskrnl.exe is the kernel but is not primarily responsible for these tasks, while Win32k.sys relates to the graphical subsystem, and Advapi32.dll is used for advanced Windows API functions, which do not include direct memory management.