File and Network Services questions mix file-system facts, command-line networking, Win32 handles, legacy Windows versions and IPC. Applying one broad "Windows" rule to every question can cost marks when a small qualifier changes the answer, such as client versus server, fixed versus removable media, or a filename versus a returned handle.
Answer these eight MCQs first. Before reading each explanation, decide whether the question tests a file, a handle, a service, a file system or an operating-system version. Then attempt the three written-response checks. Most of the set comes from real papers, from RSSB 2022 and UPPSC 2018 to IBPS 2023 and Beltron Programmer 2025, and the same Windows ground is drilled further inside CS Fundamentals for Placements.
A five-bucket method for decoding Windows service questions
Classify the noun being tested before you judge the options. Putting a question in one bucket first prevents the category error that no amount of detailed recall can undo, such as answering a handle question with a filename.
Bucket | What it means |
|---|---|
File or extension | Stored content or a legacy file-type classification |
Handle | The token returned for an opened operating-system object |
File system | NTFS or FAT features, allocation and metadata |
Network utility or service | Network configuration or client/server behaviour |
IPC | Processes exchanging messages through named pipes, mailslots or similar mechanisms |
Consider a handle trace. CreateFile() opens C:\Exam\notes.txt and returns a handle labelled H17, stored in fileHandle. ReadFile(H17, ..., 128, ...) requests up to 128 bytes through it. CloseHandle(H17) releases the reference.
CloseHandle("C:\Exam\notes.txt") passes a path, CloseHandle(lpFileName) a filename pointer, and CloseHandle(NULL) no valid handle. None closes H17. H17 is a teaching label, not a literal value to hard-code. Handles are a Win32 object concept, separate from the on-disk allocation and seek-time work in File Systems and Disk Scheduling in OS.
MCQs 1-3: legacy file types and network services
Question 1
An INT file in Windows 95 is –
A. A program file
B. A message file
C. A text file
D. Link file
Correct answer: C. A text file.
Asked in RSSB 2022. The classification this paper wants is a text file, so eliminate program file and link file rather than reading the answer as a universal rule for every .INT extension every application ships. The double spaces and the missing dot before INT are how the original paper printed it. The full working sits on the solved page for Question 1.
Question 2
Which type of support for TFTP is available from third parties, but is not included in Windows NT?
A. As client
B. As server
C. Windows NT includes full TFTP support
D. None of the above
Correct answer: B. As server.
Asked in UPPSC 2018, and read strictly as the historical Windows NT distinction. Windows NT included TFTP client support, so the role you had to source from a third party was the server. A client initiates a transfer request, while a server listens for and serves those requests. This is a legacy exam convention, not guidance about current Windows features. See the solved page for Question 2.
Question 3
Which of the following is a valid use of the netsh command in Windows?
A. To modify network interface settings.
B. To create a new directory.
C. To open the Task Manager.
D. To install a software application.
E. To check the system temperature.
Correct answer: A. To modify network interface settings.
Asked in IBPS 2023. netsh means Network Shell, so its scope is network configuration. Changing settings for an interface named Ethernet belongs to that bucket. Creating C:\Exam\Week1 belongs to file-system commands. Task Manager, software installation and temperature sensing are separate administrative jobs. Check the solved page for Question 3.
MCQs 4-6: process exit, deleted files and handle cleanup
Question 4
Which of the following is a system call used for process termination in Windows OS?
A. abort()
B. exit()
C. fork()
D. ExitProcess()
Correct answer: D. ExitProcess().
Asked in Beltron Programmer 2025. ExitProcess() is the Win32 call that ends the calling process, so it is the answer. abort() and exit() are C runtime functions, and fork() creates a process in POSIX-style systems rather than ending one. The wording "system call" is used loosely here for a Win32 API call. Open the solved page for Question 4.
Question 5
The Recycle Bin is an area in Windows OS that contains files deleted from the:
(A) hard drive
(B) Pen drive
(C) CD-ROM
Choose the correct answer from the options given below:
A. (A) only
B. (A) and (B) only
C. (B) and (C) only
D. (A) and (C) only
Correct answer: A. (A) only.
Asked in UGC NET Paper I, October 2020, and the convention is by device. A local hard drive is the Recycle Bin case, a pen drive is removable media, and a CD-ROM is not writable for an ordinary deletion. Only A remains. Treat this as an exam rule, not a promise about every storage policy or recovery tool. Review the solved page for Question 5.
Question 6
Which of the following is a correct usage of CloseHandle() after using CreateFile()?
A. CloseHandle("filename.txt");
B. CloseHandle(lpFileName);
C. CloseHandle(NULL);
D. CloseHandle(fileHandle);
Correct answer: D. CloseHandle(fileHandle).
Asked in Beltron Programmer 2025. In the H17 trace, the path identifies what to open, while CreateFile() returns H17 into fileHandle. Cleanup passes that returned handle, so CloseHandle(fileHandle) matches. A filename string, a pointer to one and NULL do not. See the solved page for Question 6.
MCQs 7-8: NTFS features and partition management
Question 7
Which of the following is a characteristic of the NTFS file system used in Windows Operating Systems?
A. It uses a File Allocation Table (FAT) to track file locations
B. It supports file compression and encryption natively
C. It does not support file permissions or Access Control Lists (ACL)
D. It is limited to maximum partition size of 32 GB
Correct answer: B. It supports file compression and encryption natively.
Eliminate by feature family. FAT is a different file-system family, and the 32 GB ceiling in option D is the Windows format tool's FAT32 limit, not an NTFS limit. NTFS supports permissions and ACLs rather than lacking them. Native compression and encryption remain. More Windows questions of this kind sit on the File and Network Services PYQ page, and File Systems and Allocation MCQs: 12 Solved Questions covers the wider FAT versus NTFS comparison.
Question 8
Which of the following versions of Windows O.S. contain built-in partition manager which allows us to shrink and expand pre-defined drives ?
A. Windows Vista
B. Windows 2000
C. Windows NT
D. Windows 98
Correct answer: A. Windows Vista.
Asked in UGC NET Paper 2, December 2014, and it is version-history recall. Of Vista, 2000, NT and 98, only Windows Vista shipped Disk Management with a built-in shrink and extend for an existing volume. That does not mean every volume can always be resized. Check the solved page for Question 8.
Written checks 9-11: IPC, recovery logging and sparse files
The last three questions carry no options. Build each response around the comparison or mechanism the question names, then add the supporting detail.
Question 9
Compare and contrast Named Pipes and Mailslots as distributed processing mechanisms in Windows 7. Clearly explain the differences between their connection types (connection-oriented vs. connectionless) and their respective use cases.
Answer frame:
State the connection model.
Compare direction and reliability expectation.
Match each mechanism to a suitable use case.
Model response: Named pipes are connection-oriented. The connection is established before communication, and both sides address a known channel, making session state possible. They suit an identified client-server exchange where ordered, dependable and potentially two-way communication matters. Mailslots are connectionless and one-way. A sender deposits a message without establishing a lasting two-way session, which suits broadcast announcements or discovery-style communication.
Mechanism | Connection and direction | Expected use |
|---|---|---|
Named pipe | Connection-oriented, potentially two-way, ordered exchange | Client-server requests and replies |
Mailslot | Connectionless, one-way delivery with a lower reliability expectation | Broadcast or service discovery |
Question 10
a) What is the significance of Transaction Logging in NTFS? Explain how file system changes are saved in log records.
b) How is metadata made consistent during crash recovery using Redo and Undo information?
Answer frame:
Identify what is logged.
Trace one metadata update.
Separate redo, undo and the user-data boundary.
Model response: (a) NTFS records metadata-changing operations so an interrupted multi-step update can be recovered to a consistent state. For example, transaction T42 records an intended directory-entry update from size=4096 bytes to size=8192 bytes, then records completion. The log lets recovery distinguish a completed update from one interrupted before completion. (b) During recovery, redo reapplies a completed change that has not yet reached disk. Undo rolls back an incomplete change. This restores metadata consistency, but it does not by itself guarantee recovery of every byte of user data.
Question 11
How does the method of managing "Sparse Files" in NTFS differ from standard compression, and how does NTFS handle the buffer when an application reads a "gap" where clusters have not been allocated?
Answer frame:
Contrast compression with an unallocated sparse region.
Calculate the logical hole and allocated data.
Explain the read result for a gap.
Model response: Compression encodes stored data into a smaller physical representation and reverses that encoding when read. A sparse file instead leaves zero-filled logical regions without allocated data clusters. The file system synthesises zeros for a requested gap, so the application receives a normal fully filled buffer without clusters stored for that hole.
For a 64 KiB logical file with 4 KiB clusters, 64 / 4 = 16 clusters. Real data occupies cluster 0 at offsets 0-4095 and cluster 15 at offsets 61440-65535. Clusters 1-14 form a 14 × 4 KiB = 56 KiB hole. An illustrative read of 4096 bytes at offset 8192, the start of cluster 2, therefore returns 4096 zero bytes. The two real-data clusters occupy 2 × 4 KiB = 8 KiB, excluding metadata and implementation overhead.
Answer-pattern review and the next practice step
Signal in the question | Reliable first move |
|---|---|
Extension or legacy format | Follow the paper's historical classification |
Client/server wording | Identify which role is absent |
Win32 resource | Pass the returned handle |
NTFS feature | Separate its security and storage features from FAT claims |
Sparse gap | Remember that unallocated storage reads as zeros |
For a 60-second self-test, classify CloseHandle(fileHandle), netsh, a named pipe and an NTFS hole before checking notes. If the buckets blur, reset with Operating System Basics MCQs: 12 Solved Questions.
For broader revision, use CS Fundamentals for Placements by Sanchit Sir. For a GATE route, use GATE Guidance by Sanchit Sir. Answer first, name the bucket, then inspect the explanation.
