220-1102 Software Troubleshooting Practice Question
A user reports that a legacy 32-bit application crashes on a Windows 10 64-bit workstation with the error '0xc0000005 (Access Violation)'. The technician has already updated the application to the latest version, installed all Windows updates, and tested the system memory with Windows Memory Diagnostic (no errors). Which of the following should the technician do NEXT to troubleshoot the issue?
⚠ Common exam trap
The trap here is that candidates often jump to reinstalling the application or running SFC without first consulting the event logs, which provide the most specific diagnostic data for access violation errors.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the Application Event Log for detailed error information
The error 0xc0000005 (Access Violation) indicates the application attempted to access an invalid memory address. Since the application is already updated, Windows updates are current, and memory diagnostics passed, the next logical step is to check the Application Event Log for detailed error information, such as faulting module names or exception codes, which can pinpoint the root cause (e.g., a missing DLL or compatibility issue). This aligns with the CompTIA troubleshooting methodology of gathering more specific data before taking further action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reinstall the application
Why it's wrong here
Reinstalling the application might resolve corruption but is a broader step. The event logs should be checked first to see if the error points to a specific DLL or driver, which would indicate a more targeted fix.
- ✗
Run the System File Checker (SFC) tool
Why it's wrong here
Running SFC would verify the integrity of protected system files, but the error 0xc0000005 on a legacy 32-bit application typically indicates a DEP (Data Execution Prevention) conflict or a compatibility shim failure, not OS file corruption. It is tempting because SFC is a standard first step for many Windows crashes, and it would be correct if the error stemmed from corrupted system files, such as after a failed update.
- ✓
Check the Application Event Log for detailed error information
Why this is correct
The Application Event Log (accessible via Event Viewer) often contains detailed crash data, such as the faulting module name and exception offset. This information can direct the technician to the specific component causing the access violation.
- ✗
Perform a clean boot to eliminate software conflicts
Why it's wrong here
Although a clean boot can isolate conflicts caused by third-party services or startup programs, it is a blanket diagnostic technique that requires restarting the system and selectively disabling half of the services. For a 0xc0000005 access violation on a legacy 32-bit app, the Application Event Log already records the faulting module, exception offset, and module version, giving a targeted diagnosis without altering the system environment. Performing a clean boot before consulting the log risks losing the ability to reproduce the exact crash context and is far more time-consuming than an immediate log review.
Go deeper
Related to this question
Learn chapter
Troubleshoot: Application Compatibility Mode
Key term
Event
An event is any identifiable occurrence or action in a computer system, network, or application that can be logged, monitored, or analyzed for security or operational purposes.
Key term
Windows
Windows is a family of operating systems developed by Microsoft that manages computer hardware and software, providing a graphical user interface for users to interact with their devices.
About these practice questions
Courseiva writes every 220-1102 question from scratch — 925 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1102 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1102 exam.