TS: Windows Internals

Preparing for an Exam The Microsoft Certification website and this preparation guide contain a variety of resources to help you prepare for an exam. Preparing for and Taking an Exam — FAQ provides answers to frequently asked questions about exam registration ,preparation ,scoring ,and policies , including: The most effective way to prepare to take an exam. The relationship between Microsoft training materials and exam content. Microsoft policy concerning the incorporation of service pack and revision updates into exam content. Exam question types and formats. Exam time limits and number of questions asked. We recommend that you review this preparation guide in its entirety and familiarize yourself with the FAQs and resources on the Microsoft Certification website before you schedule your exam.

Exam Topics CoveredThis exam validates deep technical skills in the area of Windows Internals. Including troubleshooting operating systems that are not performing as expected or applications that are not working correctly, identifying code defects, and developing and debugging applications that run unmanaged code or that are tightly integrated with the operating system, such as Microsoft SQL Server, third party applications, antivirus software, and device drivers.

Audience ProfileCandidates for this exam are engineers, developers, or IT staff who work with Windows at a level that requires Windows Internals knowledge. Candidates for this exam are typically in the upper echelon of the technical staff at their companies. These individuals typically hold such positions as escalation engineer, technical lead, and software design engineer. Their level of knowledge spans products both inside and outside the Microsoft Corporation.  These individuals are involved in resolving problems that require deep understanding of Windows Internals rather than problems about planning and infrastructure development or how to use or configure a product that runs on Windows.

Credit Toward CertificationWhen you pass Exam 70-660: TS: Windows Internals, you complete the requirements for the following certification(s):Microsoft Certified Technology Specialist (MCTS): Windows InternalsExam 70-660: TS: Windows Internals: counts as credit toward the following certification(s):N/A

Note This preparation guide is subject to change at any time without prior notice and at the sole discretion of Microsoft. Microsoft exams might include adaptive testing technology and simulation items. Microsoft does not identify the format in which exams are presented. Please use this preparation guide to prepare for the exam, regardless of its format.

Skills Being MeasuredThis exam measures your ability to accomplish the technical tasks listed below.The percentages indicate the relative weight of each major topic area on the exam.The higher the percentage, the more questions you are likely to see on that content area on the exam. The information after “This objective may include but is not limited to” is intended to further define or scope the objective by describing the types of skills and topics that may be tested for the objective. However, it is not an exhaustive list of skills and topics that could be included on the exam for a given skill area. You may be tested on other skills and topics related to the objective that are not explicitly listed here.

Identifying Architectural Components (16%) Identify memory types and mechanisms. This objective may include but is not limited to: nonpaged vs. paged; memory descriptor lists; physical memory vs. logical memory; address translation; heap memory. Identify I/O mechanisms. This objective may include but is not limited to: Plug and play; IRQL levels; I/O request packets (IRPs); I/O manager; device stacks; filter drivers; timers Identify subsystems. This objective may include but is not limited to: Object manager; cache manager; process manager; memory manager; security reference monitor Identify processor functions and architecture. This objective may include but is not limited to: Interrupts; processor affinity; system service calls; 64-bit vs. 32-bit Identify process and threads. This objective may include but is not limited to: Process environment block (PEB), thread environment block (TEB); thread scheduling, states and priority Designing Solutions (15%) Optimize a system for its drivers. This objective may include but is not limited to: driver signing; identifying filter drivers; timers and deferred procedure calls (DPCs); system worker threads; Driver Verifier Design applications. This objective may include but is not limited to: Application Verifier; gflags; kernel mode vs. user mode threads; structured exception handling (SEH); memory mapped files; authentication mechanisms; synchronization primitives Deploy compatible applications. This objective may include but is not limited to: Application Verifier; Application Compatibility Toolkit (ACT); gflags Identify optimal I/O models for applications. This objective may include but is not limited to: synchronous vs. asynchronous I/O; I/O completion ports; multithreaded applications Monitoring Windows (14%) Monitor I/O latency. This objective may include but is not limited to: Perfmon; disk I/O; application performance; device I/O Monitor I/O throughput. This objective may include but is not limited to: filter drivers; cache manager; xperf; kernrate Monitor memory usage. This objective may include but is not limited to: nonpaged vs paged pool; user memory vs. kernel memory; debugging memory leaks; memory corruption; heap corruption Monitor CPU utilization. This objective may include but is not limited to: thread time; kernel vs. user time; thread states; Perfmon; WinDbg; Xperf; Kernrate Monitor handled and unhandled exceptions. This objective may include but is not limited to: Adplus; Dr Watson; Windows Error Reporting (WER); default post-mortem debuggers; exception handling Analyzing User Mode (18%) Analyze heap leaks. This objective may include but is not limited to: UMDH (User-mode dump heap); user mode stack tracing; WinDbg; Application Verifier; Gflags; Perfmon  Analyze heap corruption. This objective may include but is not limited to: Page heap; WinDbg; Application Verifier; Gflags Handle leaks. This objective may include but is not limited to: Procmon (Process Monitor); Perfmon; WinDbg; htrace; Process Explorer; Handle.exe Resolve image load issues. This objective may include but is not limited to: Tlist; loader snaps; dll dependencies; application manifests; 64-bit applications vs. 32-bit applications; tasklist Analyze services and host processes. This objective may include but is not limited to: sc.exe; services; service dependencies; service isolation; services startup types; service registry entries Analyze cross-process application calls. This objective may include but is not limited to: RPC; LPC; shared memory; named pipes; process startup; winsock Analyze the modification of executables at runtime. This objective may include but is not limited to: WinDbg; image corruption; detours; hot patches Analyze GUI performance issues. This objective may include but is not limited to: spy++; message queues; Application Verifier; TraceTools; ATL Trace; Task Manager Analyzing Kernel Mode (19%) Find and identify objects in object manager namespaces and identify the objects’ attributes. This objective may include but is not limited to: Winobj.exe; symbolic links; object namespace; security descriptors; global namespace; device objects; file objects; object manager; semaphores Analyze Plug and Play (PnP) device failure. This objective may include but is not limited to: removal failures; global device list; WinDbg; device adds and removes; power handling Analyze pool corruption. This objective may include but is not limited to: Driver Verifier; WinDbg; pool tags; Poolmon; guard pages Analyze pool leaks. This objective may include but is not limited to: WinDbg; poolmon; Driver Verifier; crash dump analysis; paged and nonpaged pool; cache trimming Isolate the root cause of S state failure. This objective may include but is not limited to: System power states and transitions; power IRP handling Analyze kernel mode CPU utilization. This objective may include but is not limited to: kernrate.exe; WinDbg; deadlocks; Performance monitoring; event tracing Debugging Windows (18%) Debug memory. This objective may include but is not limited to: Heap; pool; virtual memory vs. physical memory; stack; analyzing crash dumps and user dumps Identify a pending I/O. This objective may include but is not limited to: WinDbg; deadlocks; I/O manager; IRP processing Identify a blocking thread. This objective may include but is not limited to: thread state; locks; synchronization objects Identify a runaway thread. This objective may include but is not limited to: thread priorities; processor affinity; Perfmon; kernrate Debug kernel crash dumps. This objective may include but is not limited to: WinDbg; DPCs; Assembler; forcing kernel crash dumps; trap processing; register usage; call stack composition (prolog/epilog); processes vs. threads Debug user crash dumps. This objective may include but is not limited to: dump types; forcing user crash dumps; gflags; system resource utilization (CPU, disk, network; memory) Set up the debugger. This objective may include but is not limited to: WinDbg; physical connection (USB, rs-232, 1394); boot.ini; bcdedit; remoting; NMI; debugging system processes

Preparation Tools and ResourcesTo help you prepare for this exam, Microsoft Learning recommends that you have hands-on experience with the product and that you use the following training resources. These training resources do not necessarily cover all of the topics listed in the "Skills Measured" tab.

Learning Plans and Classroom Training There is no classroom training currently available.

Microsoft E-Learning There is no Microsoft E-Learning training currently available.

Microsoft Press Books Windows Internals, Fifth Edition

Practice Tests There are no practice tests currently available.

Microsoft Online Resources Microsoft Learning Community: Join newsgroups and visit community forums to connect with your peers for suggestions on training resources and advice on your certification path and studies. TechNet: Designed for IT professionals, this site includes how-to instructions, best practices, downloads, technical resources, newsgroups, and chats. MSDN: Designed for developers, the Microsoft Developer Network (MSDN) features code samples, technical articles, downloads, newsgroups, and chats.