Free Windows Operating System Features and Tools practice questions

When the Disk column stays at 100 percent with low CPU and a sync client is clearly responsible, the safest move is to pause or exit that sync application if policy permits, or allow it to complete if it is a one-time indexing event. This targets the confirmed cause without risking data loss. Ending unknown Windows system tasks is a high-risk action because terminating the wrong system process can crash the OS or corrupt data, and it does not address the identified sync client. Restarting immediately may interrupt an indexing operation that will simply resume after boot, so the symptom returns without being understood. Disabling the disk controller driver would render storage inaccessible and could make the system unbootable, which is far more disruptive than the original slowdown. Good troubleshooting confirms the stressed resource, identifies the responsible process, and then applies the least risky action. Because the evidence already points to the sync client, working with that specific application is both the most targeted and the lowest-risk response.

Ctrl + Shift + Esc opens Task Manager directly, which is exactly what you need when the mouse is dead and the PC is only partly responsive. Ctrl + Alt + Delete goes to the security screen first, from which Task Manager must then be selected, so it is an extra step rather than a direct launch. Windows key + X opens the power-user menu, a list of tools that still needs a further selection. Windows key + R opens the Run box, where you would have to type taskmgr before anything appears. When input is limited, the single direct shortcut is the most reliable route.

The Startup tab is the correct first stop for slow sign-in and boot delays because it lists the programs that launch automatically at sign-in and shows their startup impact. Disabling non-essential third-party startup items such as updaters, chat helpers, and launchers is a low-risk change that often restores fast logons. The Services tab lists background Windows components and is best used when a specific feature fails, such as printing or updates, rather than for general slow boot. The Users tab shows resource use per signed-in session and is most helpful on shared machines where another account is consuming resources, not for a single user's slow sign-in. The Performance tab displays live graphs of CPU, memory, disk, and network use and helps identify which hardware resource is under load, but it does not let you manage which programs run at startup. Because the complaint is specifically about the first few minutes after sign-in, the Startup tab most directly connects the symptom to an actionable, reversible fix.

The Network tab in Resource Monitor shows Send (B/sec) and Receive (B/sec) per process along with Listening Ports, so heavy outbound traffic from a process that should not be uploading data is exactly the evidence you need to confirm suspicious activity. The Disk tab and its Total (B/sec) figures reveal read and write activity, which helps diagnose slow load times or a busy drive but says nothing about data leaving the machine over the network. The CPU tab lists highest-activity processes and helps when something is consuming processor time, such as slow typing caused by a background loop, but it does not track network throughput. The Memory tab's Hard Faults per second indicate paging pressure, meaning Windows is moving data between RAM and disk, which points to insufficient memory rather than network uploads. Because the concern is unexpected outbound data transfer, the Network tab with Send rates and Listening Ports is the correct place to look, allowing the technician to name the process and decide whether a malware scan is warranted.

When an app shows "Not responding" but disk usage is high and clearly tied to that app, the best first step is to wait briefly, because the application may simply be busy reading or writing a large file or waiting on a network share. Force-closing too early risks losing unsaved work in an app that would have recovered on its own. Immediately selecting End task is premature; you should first give the app a chance to finish and try closing it normally, ending it only if it stays stuck and the user cannot proceed. Restarting Windows Explorer addresses a stuck taskbar or desktop shell, not a single application that is actively working on a file. Rebooting is reserved for when the shell is unstable or multiple apps fail at once, and it would discard any unsaved data in the busy application. The decision path prioritizes saving the user's work: wait when disk activity shows the app is progressing, attempt a normal close, and only escalate to End task or a reboot when the situation does not improve.

The command dfrgui opens the Optimize Drives utility, and defragmentation primarily benefits hard disk drives. HDDs store data on spinning platters, so when files scatter across the disk the drive head must travel farther, reducing performance; defragmentation reorders file blocks to reduce that head movement. The option pairing cleanmgr with SSDs is wrong on both counts: cleanmgr launches Disk Cleanup, which removes temporary and cached files rather than defragmenting, and it is not the optimization tool. Pairing dfrgui with SSDs uses the correct command but the wrong benefit, because solid-state drives have no moving head, so classic defragmentation is not a performance fix; Windows instead sends TRIM commands and performs flash-appropriate maintenance. The option listing resmon opens Resource Monitor, which monitors live performance and does not optimize drives at all. For the exam, remember both the executable name and the key distinction that defrag helps HDDs while SSDs should be left to Windows scheduled optimization unless a scenario directs otherwise.

In System Configuration, checking Hide all Microsoft services before disabling anything ensures you only turn off third-party services, which greatly reduces the chance of disabling a core Windows function needed for normal operation. From there you disable third-party services in small groups, reboot, and test, using a split-the-difference method to isolate the culprit. Disabling every listed service without hiding Microsoft services risks turning off essential system components and can cause serious instability or prevent proper boot. Enabling Safe boot with Network for all future startups would trap the system in a restricted boot loop until the setting is reverted, and it is meant for temporary diagnostics rather than permanent use. System Configuration does not delete service entries; it only enables or disables them, and attempting to remove services here is not how the tool works. Controlled, reversible testing is the goal, so hiding Microsoft services first and toggling third-party items in groups is the safe, methodical approach. Documenting each change is essential so every modification can be reversed after testing concludes.

On a shared PC, the Users tab reveals that each signed-in session, even when locked, can consume CPU and memory. When another account is clearly holding large amounts of memory and slowing the machine for everyone, the appropriate action is to sign off that session after coordinating with the other user and warning them about unsaved work, which releases the resources and often resolves the mystery slowdown. Ending all processes under the current user's session does not address the real cause, which is the other account, and would disrupt the person actively using the machine. Disabling a service targets a specific Windows feature failure, not a case where a separate user session is monopolizing memory, and the service may not even be the source. Increasing the paging file size only provides slower disk-based backup memory and would not fix a session that is already consuming excessive RAM; it masks the symptom rather than resolving it. Because the evidence points to a specific user session, signing that session off with permission is the targeted, low-risk fix.

Before editing the registry, exporting the affected key or branch through File > Export creates a backup file that provides a rollback path if the change breaks an app or a login. This small, controlled precaution is essential because the registry stores configuration for the OS, users, drivers, and applications, and a bad edit can be difficult to undo without a saved copy. Running Disk Cleanup would remove temporary files and could delete useful cached data, but it does not back up the registry and is unrelated to preparing for a safe edit. Enabling Safe boot changes how Windows starts and is used to isolate driver or service problems; it does not protect a specific registry value and could complicate the task if left enabled. Deleting the existing value before making a change discards the current setting with no way to restore it, which is the opposite of a safe rollback strategy. In exam scenarios, Registry Editor usually appears as "check or set this value at this path," and the professional habit is to back up first, change only what you understand, and test after each small edit.

Low CPU usage combined with memory sitting near maximum and very low available memory is the classic signature of memory pressure. When available RAM stays low, Windows relies on paging, moving data between RAM and disk to act as backup memory, which feels like slow app switching and frequent pauses. Thermal throttling of the CPU would show sustained high CPU usage and heat, but here CPU is low, so throttling does not fit the observed graphs. A network transfer saturating bandwidth would appear as high activity on the network graph and would explain slow downloads or choppy calls, not slow app switching driven by low memory. A failing hard drive returning read errors is a possibility for storage problems, but the described evidence specifically points to exhausted memory forcing paging rather than physical drive faults, which would typically surface in disk health checks or Event Viewer logs. High memory use alone is not always a problem, but trouble begins when available memory stays low and the system pages heavily, which matches this scenario precisely.