Why might a kernel-mode component need to create a system thread or queue a work item to a system worker thread?
A) The component must perform work not requested by a user thread (e.g., flushing dirty pages to disk).
B) The component is unable to perform all interrupt processing at an elevated IRQL.
C) The component must share handles with a user-mode process.
D) Both a and b.

Question

Quizplus · Accepted Answer

Kernel-mode components may need to create system threads or queue work items to handle tasks that are not initiated by user threads, such as background operations like flushing dirty pages to disk (A). Additionally, they may need to defer work that cannot be completed at an elevated IRQL, which is often the case with interrupt processing (B).

Why Might a Kernel-Mode Component Need to Create a System