220-1102 Software Troubleshooting Practice Question
A user reports that a critical line-of-business application crashes intermittently with an exception code 0xc0000005 (Access Violation) in the Event Viewer. The technician has already updated all drivers, installed Windows updates, and ran System File Checker (SFC), which found no corruption. Which step should the technician take NEXT to resolve the issue?
⚠ Common exam trap
Candidates often assume a software-only cause for application crashes and jump to compatibility mode or System Restore, overlooking the hardware memory diagnostic step that directly addresses the access violation error code.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run the Windows Memory Diagnostic tool to test for faulty RAM
The exception code 0xc0000005 (Access Violation) often indicates a memory access error, which can be caused by faulty RAM. Since the technician has already updated drivers, installed Windows updates, and run SFC without finding corruption, the next logical step is to test the physical memory using the Windows Memory Diagnostic tool. This isolates hardware issues before pursuing more complex software troubleshooting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reinstall the application in compatibility mode for an older version of Windows
Why it's wrong here
Compatibility mode changes the Windows version reported to the application, which helps with legacy API or driver differences, but it does not address underlying memory instability. A 0xc0000005 access violation is typically caused by faulty RAM or corrupted executable code, not by an OS-version mismatch. Forcing compatibility mode could even mask the real defect while the hardware continues to degrade.
- ✓
Run the Windows Memory Diagnostic tool to test for faulty RAM
Why this is correct
The Windows Memory Diagnostic tool performs a low-level scan of physical RAM during system restart, detecting bad memory chips, timing issues, or other hardware faults. Intermittent access violation errors like 0xc0000005 are frequently the result of defective memory, where a program attempts to read from or write to an invalid memory address. Because SFC and driver updates have already ruled out system file corruption and software drivers, testing RAM is the logical next step to isolate a hardware-level cause.
- ✗
Disable User Account Control (UAC) to allow the application unrestricted access
Why it's wrong here
Disabling UAC lowers the integrity level of all running processes, but it does not change how the CPU's memory management unit handles pointer references or address validity. The 0xc0000005 error is an access violation at the hardware and memory layer, completely unrelated to user permission prompts. Furthermore, disabling UAC seriously weakens system security and is not a sanctioned troubleshooting action for a line-of-business application crash.
- ✗
Perform a System Restore to revert the system to a state before the issue started
Why it's wrong here
A System Restore reverts registry settings and system files to a prior snapshot, but the technician has already confirmed no system file corruption via SFC and updated drivers and Windows updates. The 0xc0000005 error often originates from a corrupted application installation, memory faults, or incompatible third-party software, none of which a restore point would address if the root cause is not a recent system configuration change. This option is tempting because System Restore is a standard troubleshooting step for issues caused by faulty updates or driver changes, and it would be correct if the problem began immediately after a specific software installation or Windows update.
Visual reference
Go deeper
Related to this question
Learn chapter
Linux File System Structure
Key term
Event
An event is any identifiable occurrence or action in a computer system, network, or application that can be logged, monitored, or analyzed for security or operational purposes.
Key term
Event Viewer
Event Viewer is a built-in Windows tool that logs system, security, and application events to help administrators monitor and troubleshoot issues.
About these practice questions
Courseiva writes every 220-1102 question from scratch — 925 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1102 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1102 exam.