CCNA Software Troubleshooting Questions

Multi-Selectmedium

A user's Windows 10 laptop has become increasingly slow over the past month. The hard drive activity light is constantly on, and the system often freezes for several seconds. A technician suspects the issue is related to a failing hard disk drive (HDD). Which two of the following should the technician perform to confirm the diagnosis? (Choose two.)

Select 2 answers

A.Use Disk Cleanup to remove temporary files.

B.Run the Windows Memory Diagnostic tool.

C.Check the S.M.A.R.T. status using a diagnostic tool.

D.Run chkdsk /r from an elevated command prompt.

E.Defragment the hard drive using the built-in Windows tool.

AnswersC, D

S.M.A.R.T. (Self-Monitoring, Analysis, and Reporting Technology) provides early warning of impending disk failure. Tools like CrystalDiskInfo or the manufacturer's utility can read attributes such as reallocated sectors and pending sectors. A failing S.M.A.R.T. status strongly indicates the drive should be replaced.

Why this answer

To confirm a failing HDD, the technician should check S.M.A.R.T. data for warning signs and run chkdsk /r to scan for and recover bad sectors. These tools directly assess the drive's health and can reveal physical errors, unlike defragmentation, memory testing, or disk cleanup, which address other issues.

Exam trap

The trap here is confusing performance optimization tools like defragmentation with diagnostic tools; defragmentation can worsen a failing drive and does not confirm hardware failure.

Practice this question →

MCQeasy

A user complains that their Windows 10 computer takes a very long time to start up and become responsive after logging in. They have not installed any new programs. Which of the following should a technician check FIRST to improve startup performance?

A.The System Configuration utility (msconfig) to set a selective startup.

B.The Event Viewer to look for errors during startup.

C.The Disk Management console to check for disk errors.

D.The Task Manager Startup tab to disable unnecessary startup programs.

AnswerD

The Startup tab in Task Manager shows programs that launch at login and their impact on startup time. Disabling non-essential startup items is a quick, safe way to reduce boot time and improve responsiveness. This is a standard first step for slow startup issues.

Why this answer

Slow startup and login are often caused by too many programs launching at startup. Task Manager's Startup tab lists these programs and their impact, allowing a technician to disable unnecessary ones. This is a quick, reversible step that often resolves the issue without deeper troubleshooting.

Other tools are either not first-line or target different problems.

Exam trap

The trap here is overcomplicating the troubleshooting by diving into Event Viewer or msconfig when the most common and easily fixable cause is excessive startup programs.

Practice this question →

MCQhard

A technician is troubleshooting a Windows 10 workstation that repeatedly displays a message stating "The User Profile Service failed the logon. User profile cannot be loaded." The user can log in with a different account. Which of the following should the technician do to allow the user to log in with their original profile while preserving their data?

A.Delete the user's profile folder from C:\Users and have the user log in again.

B.Recreate the user's account and copy the contents of the old profile folder to the new one.

C.Run the System File Checker (SFC) utility to repair corrupted system files.

D.Use the Registry Editor to modify the ProfileList key and remove the .bak extension from the user's SID.

AnswerD

This error often occurs when the user's profile is corrupted, and the ProfileList registry key may have a .bak extension appended to the user's SID. Removing the .bak extension and ensuring the correct profile path is set can restore the profile without losing data. This is a standard fix for this specific error.

Why this answer

The "User Profile Service failed the logon" error typically stems from a corrupted user profile, often indicated by a .bak extension on the user's SID in the ProfileList registry key. Removing the .bak extension and correcting the profile path restores the original profile without data loss. Other methods either delete data or are less direct.

Exam trap

The trap here is jumping to profile deletion or recreation when a simple registry edit can resolve the issue while preserving user data.

Practice this question →

MCQeasy

A technician is troubleshooting a Windows 10 workstation that repeatedly shows a message stating the operating system could not be found. The drive is detected in UEFI/BIOS, and the technician suspects the boot configuration is damaged. Which command should the technician run from the Windows Recovery Environment to rebuild the Boot Configuration Data store?

A.chkdsk /r

B.bootrec /rebuildbcd

C.diskpart /clean

D.bootrec /fixmbr

AnswerB

This command scans all disks for Windows installations and rebuilds the Boot Configuration Data store, which is exactly what is needed when the BCD is damaged and the OS cannot be located at boot. It is the targeted repair for this symptom on both BIOS and UEFI systems.

Why this answer

When the Boot Configuration Data store is damaged, Windows cannot locate the operating system even though the disk is healthy. The bootrec /rebuildbcd command scans for installations and reconstructs the BCD, directly addressing the symptom. The other commands either repair the wrong boot component, destroy data, or check disk surface errors rather than the boot database.

Exam trap

The trap here is confusing MBR repair with BCD repair, since both are bootrec subcommands but affect different boot architectures and components.

Practice this question →

MCQmedium

A user reports that their Windows 11 laptop occasionally shows a blue screen with the stop code CRITICAL_PROCESS_DIED. The issue occurs randomly, about once every two days. The user has not installed any new hardware or software recently. Which of the following should a technician perform FIRST to troubleshoot this issue?

A.Run the System File Checker (SFC) utility.

B.Update the graphics card driver to the latest version.

C.Replace the hard drive with a new solid-state drive (SSD).

D.Perform a clean installation of Windows 11.

AnswerA

SFC is a built-in Windows tool that scans for and repairs corrupted system files, which can cause CRITICAL_PROCESS_DIED. Since the issue occurs randomly and no recent changes were made, corrupted system files are a likely cause. Running SFC is a safe, non-destructive first step that may resolve the problem without further disruption.

Why this answer

CRITICAL_PROCESS_DIED indicates that a critical system process has terminated unexpectedly, often due to corrupted system files. Running System File Checker (SFC) is a standard first step because it can repair those files without data loss. Other options are either too invasive or target the wrong subsystem, making SFC the most appropriate initial action.

Exam trap

The trap here is assuming that any blue screen requires a clean install or hardware replacement, when in fact software corruption is a common cause that can be fixed with built-in utilities.

Practice this question →

MCQeasy

A user complains that every time they open their web browser, the homepage has changed to an unfamiliar search site and new toolbars appear. They did not change these settings. Which of the following is the MOST likely cause?

A.The browser has been infected with a potentially unwanted program (PUP).

B.The DNS server is returning incorrect results.

C.The user's roaming profile is corrupt.

D.The browser needs to be updated to the latest version.

AnswerA

Unwanted changes to the homepage and the appearance of new toolbars without user action are classic signs of a potentially unwanted program, often bundled with free software. PUPs modify browser settings and can redirect searches. Removing the PUP and resetting the browser settings addresses the root cause.

Why this answer

The sudden appearance of toolbars and homepage changes without user action is characteristic of a potentially unwanted program. These are often bundled with free downloads and modify browser settings. The correct response is to identify and uninstall the PUP, then reset the browser to its default configuration to remove any remaining changes.

Exam trap

The trap here is attributing browser hijacking symptoms to network or profile issues instead of recognizing the hallmark signs of unwanted software.

Practice this question →

MCQhard

A user's Windows 11 laptop has become extremely slow, and Task Manager shows constant 100% disk usage with very low actual read/write throughput. The drive is a SATA SSD, and the system is fully updated. A technician notices the drive is using the standard Microsoft AHCI driver. Which of the following is the MOST likely cause?

A.The paging file is disabled, forcing excessive disk access.

B.The SSD is failing and should be replaced immediately.

C.Windows Search indexing is still building its initial index.

D.The drive is using the wrong storage controller driver, causing high latency.

AnswerD

When a SATA SSD runs on the generic Microsoft AHCI driver instead of the vendor's optimized driver, or when the controller mode changed after an update, latency can spike and queue depth suffers, producing 100% active time with minimal throughput. Installing the correct chipset or storage driver from the manufacturer typically resolves this.

Why this answer

High disk active time with almost no throughput on a SATA SSD often stems from the storage controller driver. The generic Microsoft AHCI driver may not handle the drive's queuing and power features efficiently, causing latency. Installing the correct chipset or storage driver from the system or motherboard vendor is the most likely fix, after confirming SMART health is good.

Exam trap

The trap here is jumping to hardware failure when the symptom of high active time with low throughput more specifically points to a storage driver or controller configuration issue.

Practice this question →

MCQmedium

A user reports that their Android smartphone is running very slowly, the battery drains quickly, and they see frequent pop-up ads even when not using the browser. The user installed several apps from a third-party app store recently. Which of the following is the MOST likely cause of these symptoms?

A.The device needs a factory reset to clear cache.

B.The device has been infected with malware.

C.The device's storage is nearly full.

D.The battery is failing and needs replacement.

AnswerB

The combination of slow performance, battery drain, and pop-up ads outside the browser is classic malware behavior on Android. Third-party app stores are common sources of malicious apps. Malware can run background processes, display ads, and steal resources, causing these exact symptoms.

Why this answer

The symptoms of slow performance, battery drain, and pop-up ads appearing outside the browser are indicative of malware, especially adware. Installing apps from third-party stores increases the risk. While other issues like full storage or battery problems can cause some symptoms, they do not explain the ads.

Malware is the most likely cause.

Exam trap

The trap here is attributing all performance issues to hardware or storage when the presence of pop-up ads strongly suggests malware.

Practice this question →

MCQeasy

A user reports that their Android smartphone is running very slowly and the battery drains quickly, even when the phone is idle. The user recently installed several new apps from a third-party app store. Which of the following should a technician do FIRST to troubleshoot the issue?

A.Update the Android operating system to the latest version.

B.Uninstall all apps installed from the third-party store.

C.Check the battery usage statistics to identify power-hungry apps.

D.Perform a factory reset of the device.

AnswerC

Battery usage statistics show which apps consume the most power. Since the problem started after installing new apps, reviewing this list can quickly pinpoint a malicious or poorly coded app. This is a non-destructive first step that directly addresses the symptom and guides further action.

Why this answer

When a phone slows down and battery drains after installing new apps, the most efficient first step is to review battery usage statistics. This built-in tool identifies which apps are consuming the most power, allowing the technician to target the likely culprit without erasing data or removing all new apps.

Exam trap

The trap here is jumping to a factory reset or mass uninstallation instead of using built-in diagnostic data to identify the specific offending app.

Practice this question →

Multi-Selecthard

A technician is troubleshooting a Windows 10 workstation that is exhibiting symptoms of a malware infection. The technician has already disconnected the computer from the network. Which of the following should the technician do next to remediate the infection? (Choose two.)

Select 2 answers

A.Enable System Restore and create a restore point.

B.Run a full antivirus scan using updated definitions.

C.Boot into Safe Mode and run additional malware removal tools.

D.Reimage the computer immediately without attempting removal.

E.Educate the user on safe browsing habits.

AnswersB, C

After isolating the system, running a full antivirus scan with the latest definitions is essential to detect and remove malware. Updated definitions ensure the scanner recognizes current threats. This step is a core part of malware remediation and should be performed before restoring network access.

Why this answer

After isolating the infected system, the technician should run a full antivirus scan with updated definitions to detect and remove malware. Additionally, booting into Safe Mode and using specialized removal tools helps eliminate persistent infections that might resist normal removal. These two actions directly address the malware, while other options are either preventive, premature, or not directly remedial.

Exam trap

The trap here is choosing reimaging or user education as immediate remediation steps, when they are either too drastic or do not address the active infection.

Practice this question →

MCQmedium

A user reports that after installing a new third-party disk cleanup utility, Windows 11 randomly displays a blue screen with the stop code CRITICAL_PROCESS_DIED. The system boots normally in Safe Mode, and the issue does not occur there. Which of the following is the BEST first step to resolve the issue?

A.Run System File Checker (SFC) with the /scannow parameter.

B.Perform a System Restore to a point before the utility was installed.

C.Run the Windows Memory Diagnostic tool to test for faulty RAM.

D.Uninstall the third-party disk cleanup utility in Safe Mode.

AnswerD

The timeline directly links the new utility to the CRITICAL_PROCESS_DIED stop code, and the absence of crashes in Safe Mode confirms a third-party driver or service is responsible. Removing that utility in Safe Mode eliminates the faulty component and is the least invasive, most targeted first step before considering broader repairs.

Why this answer

The crash appeared only after installing a third-party cleanup tool and does not occur in Safe Mode, which strongly indicates a problematic third-party driver or service. Uninstalling that utility in Safe Mode removes the offending component directly. Broader repairs like SFC, System Restore, or memory testing are either unnecessary or address causes not supported by the evidence.

Exam trap

The trap here is assuming any blue screen requires running SFC or memory diagnostics first instead of correlating the crash with the most recent software change.

Practice this question →

MCQmedium

A user reports that after installing a new third-party backup utility, their Windows 11 computer takes several minutes to reach the desktop and shows a black screen with a spinning circle. The user wants to keep the backup utility but needs faster boot times. A technician opens Task Manager and notices the backup utility has a 'High' startup impact. Which of the following should the technician do FIRST to resolve the slow boot?

A.Disable the backup utility in the Startup tab of Task Manager.

B.Perform a clean boot using msconfig and disable all non-Microsoft services.

C.Use msconfig to set the computer to Safe Boot with minimal services.

D.Run the System File Checker (sfc /scannow) to repair corrupted system files.

AnswerA

Disabling the startup entry prevents the utility from launching at boot, directly addressing the high startup impact. The application remains installed and can be launched manually when needed, so the user keeps it while boot time improves. This is the least invasive first step before considering uninstallation or more drastic measures.

Why this answer

Task Manager's Startup tab shows the impact of each startup program. When a specific application is flagged as high impact and the timing correlates with its installation, disabling that startup entry is the most direct and least disruptive fix. It preserves the application for manual use and avoids unnecessary system-wide changes.

Exam trap

The trap here is assuming that a slow boot always requires a system file repair or a clean boot, when the startup impact data already points to a specific third-party application.

Practice this question →