220-1102 Software Troubleshooting Practice Question
A user reports that a critical business application crashes immediately after launch on Windows 10. The technician has already run System File Checker (SFC) and DISM, both of which reported no corruption. The application was working before a recent Windows Update. Which tool should the technician use NEXT to identify the cause of the crash?
⚠ Common exam trap
The trap here is that candidates often jump to System Restore as a quick fix for update-related issues, but the question specifically asks for a tool to 'identify the cause,' not to resolve it, making Event Viewer the correct diagnostic choice.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Event Viewer
Event Viewer (Option B) is the correct next step because it logs detailed application and system errors, including crash events with faulting module names, exception codes, and stack traces. Since SFC and DISM found no corruption, the crash likely stems from a compatibility or dependency issue triggered by the recent Windows Update, and Event Viewer can pinpoint the specific faulting module (e.g., a DLL or driver) causing the failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
System Restore
Why it's wrong here
System Restore can only revert the operating system's core files, registry keys, and certain program installations to a previous restore point; it does not analyze or expose the error details that caused the application to crash. Launching a restore blindly could remove recent updates or drivers that are unrelated to the crash, and you would have no confirmation that the restore point actually predates the fault. The correct first step is to consult Event Viewer's Application log to isolate the faulting module, then use System Restore only if the evidence points to a recent system change as the trigger.
- ✓
Event Viewer
Why this is correct
Event Viewer is the authoritative diagnostic tool for this scenario because its Windows Logs > Application section records every application error with a specific Event ID, the source (such as the application name or .NET Runtime), the faulting module (for example, a DLL or EXE), and the exception code (such as 0xc0000409 or 0xc000007b). This detailed log reveals whether the crash is caused by a missing dependency, a corrupted config file, or a recent patch, allowing the technician to fix the root cause rather than guessing. It is the correct first tool to check immediately after a crash.
- ✗
Performance Monitor
Why it's wrong here
Performance Monitor is a performance-analysis utility that collects and displays real-time or logged counters for CPU, memory, disk, network, and other resource objects, making it useful for spotting trends or bottlenecks over time. It does not capture crash events, faulting modules, exception codes, or any log of what caused a particular application to terminate. Therefore, it cannot provide the forensic details needed to diagnose why a business application crashes immediately after launch.
- ✗
Task Manager
Why it's wrong here
Task Manager displays only the processes that are currently running, along with their CPU, memory, disk, and network usage, and it can end a process or restart it, but it retains no historical error data. Once the application has crashed, its process no longer exists, so Task Manager cannot show any error code, faulting module, or event log entry for that failure. Looking at Task Manager after an immediate crash would reveal nothing about the underlying cause, so it is not a valid diagnostic tool for this problem.
Go deeper
Related to this question
Learn chapter
Troubleshoot: Permission Denied Errors
Key term
Event Viewer
Event Viewer is a built-in Windows tool that logs system, security, and application events to help administrators monitor and troubleshoot issues.
Key term
Event
An event is any identifiable occurrence or action in a computer system, network, or application that can be logged, monitored, or analyzed for security or operational purposes.
About these practice questions
Courseiva writes every 220-1102 question from scratch — 925 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 220-1102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A user reports that a line-of-business application crashes on startup with error 'The application was unable to start correctly (0xc0000142)'. The technician has verified that the application works on other workstations and has reinstalled it. The technician also ran SFC and DISM with no errors. Which of the following should the technician do NEXT?
medium- A.Use Task Manager to end the process and restart the application.
- ✓ B.Check Event Viewer for application-specific error details.
- C.Perform a system restore to a point before the issue started.
- D.Run the application in Windows 8 compatibility mode.
Why B: The error code 0xc0000142 indicates a STATUS_DLL_INIT_FAILED condition, meaning a required DLL failed to initialize during application startup. Since SFC and DISM found no system file corruption and the application works on other workstations, the issue is likely environment-specific, such as a missing dependency or a corrupted user profile. Checking Event Viewer under Windows Logs > Application provides detailed error logs, including faulting module names and exception codes, which can pinpoint the exact cause without guesswork.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1102 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1102 exam.