- Exam Details
- Trouble Spots / Preparation Hints / Recommended Study Resources
- Exam Objectives / Where to Go from Here
Exam Objectives
The exam objectives are broken up into six different categories. This exam validates in depth technical skills in the area of Windows Internals, which include troubleshooting operating systems that are not performing as expected or applications that are not working correctly, identifying code defects, and developing and debugging applications that run unmanaged code or that are tightly integrated with the operating system, such as Microsoft SQL Server, third party applications, antivirus software, and device drivers.
The percentages indicate the relative weight of each major topic area on the exam. The higher the percentage, the more questions you are likely to see on that content area on the exam.
The objectives for Exam 70-660 as stated by Microsoft are as follows:
Identifying Architectural Components (16%)
- Identify memory types and mechanisms.
- Identify I/O mechanisms.
- Identify subsystems.
- Identify processor functions and architecture.
- Identify process and threads.
This objective may include but is not limited to: nonpaged vs. paged; memory descriptor lists; physical memory vs. logical memory; address translation; heap memory.
This objective may include but is not limited to: Plug and play; IRQL levels; I/O request packets (IRPs); I/O manager; device stacks; filter drivers; timers
This objective may include but is not limited to: Object manager; cache manager; process manager; memory manager; security reference monitor
This objective may include but is not limited to: Interrupts; processor affinity; system service calls; 64-bit vs. 32-bit
This objective may include but is not limited to: Process environment block (PEB); thread environment block (TEB); thread scheduling, states and priority
Designing Solutions (15%)
- Optimize a system for its drivers.
- Design applications.
- Deploy compatible applications.
- Identify optimal I/O models for applications.
This objective may include but is not limited to: driver signing; identifying filter drivers; timers and deferred procedure calls (DPCs); system worker threads; Driver Verifier
This objective may include but is not limited to: Application Verifier; gflags; kernel mode vs. user mode threads; structured exception handling (SEH); memory mapped files; authentication mechanisms; synchronization primitives
This objective may include but is not limited to: Application Verifier; Application Compatibility Toolkit (ACT); gflags
This objective may include but is not limited to: synchronous vs. asynchronous I/O; I/O completion ports; multithreaded applications
Monitoring Windows (14%)
- Monitor I/O latency.
- Monitor I/O throughput.
- Monitor memory usage.
- Monitor CPU utilization.
- Monitor handled and unhandled exceptions.
This objective may include but is not limited to: Perfmon; disk I/O; application performance; device I/O
This objective may include but is not limited to: filter drivers; cache manager; xperf; kernrate
This objective may include but is not limited to: nonpaged vs paged pool; user memory vs. kernel memory; debugging memory leaks; memory corruption; heap corruption
This objective may include but is not limited to: thread time; kernel vs. user time; thread states; Perfmon; WinDbg; Xperf; Kernrate
This objective may include but is not limited to: Adplus; Dr Watson; Windows Error Reporting (WER); default post-mortem debuggers; exception handling
Analyzing User Mode (18%)
- Analyze heap leaks.
- Analyze heap corruption.
- Handle leaks.
- Resolve image load issues.
- Analyze services and host processes.
- Analyze cross-process application calls.
- Analyze the modification of executables at runtime.
- Analyze GUI performance issues.
This objective may include but is not limited to: UMDH (User-mode dump heap); user mode stack tracing; WinDbg; Application Verifier; Gflags; Perfmon
This objective may include but is not limited to: Page heap; WinDbg; Application Verifier; Gflags
This objective may include but is not limited to: Procmon (Process Monitor); Perfmon; WinDbg; htrace; Process Explorer; Handle.exe
This objective may include but is not limited to: Tlist; loader snaps; dll dependencies; application manifests; 64-bit applications vs. 32-bit applications; tasklist
This objective may include but is not limited to: sc.exe; services; service dependencies; service isolation; services startup types; service registry entries
This objective may include but is not limited to: RPC; LPC; shared memory; named pipes; process startup; winsock
This objective may include but is not limited to: WinDbg; image corruption; detours; hot patches
This objective may include but is not limited to: spy++; message queues; Application Verifier; TraceTools; ATL Trace; Task Manager
Analyzing Kernel Mode (19%)
- Find and identify objects in object manager namespaces and identify the objects’ attributes.
- Analyze Plug and Play (PnP) device failure.
- Analyze pool corruption.
- Analyze pool leaks.
- Isolate the root cause of S state failure.
- Analyze kernel mode CPU utilization.
This objective may include but is not limited to: Winobj.exe; symbolic links; object namespace; security descriptors; global namespace; device objects; file objects; object manager; semaphores
This objective may include but is not limited to: removal failures; global device list; WinDbg; device adds and removes; power handling
This objective may include but is not limited to: Driver Verifier; WinDbg; pool tags; Poolmon; guard pages
This objective may include but is not limited to: WinDbg; poolmon; Driver Verifier; crash dump analysis; paged and nonpaged pool; cache trimming
This objective may include but is not limited to: System power states and transitions; power IRP handling
This objective may include but is not limited to: kernrate.exe; WinDbg; deadlocks; Performance monitoring; event tracing
Debugging Windows (18%)
- Debug memory.
- Identify a pending I/O.
- Identify a blocking thread.
- Identify a runaway thread.
- Debug kernel crash dumps.
- Debug user crash dumps.
- Set up the debugger.
This objective may include but is not limited to: Heap; pool; virtual memory vs. physical memory; stack; analyzing crash dumps and user dumps
This objective may include but is not limited to: WinDbg; deadlocks; I/O manager; IRP processing
This objective may include but is not limited to: thread state; locks; synchronization objects
This objective may include but is not limited to: thread priorities; processor affinity; Perfmon; kernrate
This objective may include but is not limited to: WinDbg; DPCs; Assembler; forcing kernel crash dumps; trap processing; register usage; call stack composition (prolog/epilog); processes vs. threads
This objective may include but is not limited to: dump types; forcing user crash dumps; gflags; system resource utilization (CPU, disk, network; memory)
This objective may include but is not limited to: WinDbg; physical connection (USB, rs-232, 1394); boot.ini; bcdedit; remoting; NMI; debugging system processes
Where to Go from Here
After you pass the Microsoft Windows Internals (70-660) exam, you may want to take Exam 70-685: Pro: Windows 7, Enterprise Desktop Support Technician.