220-1102 Software Troubleshooting Practice Question
A user reports that a line-of-business application on Windows 10 crashes immediately after launch. The technician has already run System File Checker (SFC) and DISM, which found no corruption. The application was working correctly before a recent Windows Update. Which built-in tool should the technician use NEXT to identify the cause of the crash?
⚠ Common exam trap
Test-takers frequently choose Task Manager thinking it can show crash details, but Task Manager only shows real-time process status and cannot display historical error logs or specific fault information that Event Viewer provides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Event Viewer
Event Viewer (B) is the correct next step because it logs detailed application error events, including crash dumps and faulting module information. Since SFC and DISM found no system corruption, the crash is likely caused by a compatibility issue or a faulty update, and Event Viewer's Application or System logs will show the specific error code, module, and exception that caused the crash.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Task Manager
Why it's wrong here
Task Manager can show the application in the Processes or Apps list as 'Running' just before the crash, then see it disappear entirely, and its status history does not include any error details. It lacks a logging subsystem, so while it can verify the process is no longer alive and let you relaunch it, it cannot identify the faulting module, exception code, or any other forensic insight needed to diagnose an immediate crash.
- ✓
Event Viewer
Why this is correct
Event Viewer's Windows Logs > Application node records crash details for every application fault via Windows Error Reporting. Look for Event ID 1000 (Application Error), which includes the faulting module name, faulting module path, exception code (e.g., 0xc0000005 for access violation), and faulting module timestamp—a direct way to identify a corrupted dependency or driver-level incompatibility. The immediate crash leaves a WER event that Event Viewer surfaces, making it the correct diagnostic source.
- ✗
Performance Monitor
Why it's wrong here
Performance Monitor (perfmon.exe) tracks performance counters over time via Data Collector Sets and can log CPU, memory, or disk counters for later review, but it does not capture application exception information, stack traces, or module load errors. Even with a custom counter log, a crashed process's counters are lost at termination, so it can only suggest resource exhaustion had occurred, not explain why the application crashed.
- ✗
Resource Monitor
Why it's wrong here
Resource Monitor's five tabs (Overview, CPU, Memory, Disk, Network) visualize real-time performance counters and per-process handle/module activity, so it can confirm whether the crashed process is gone or hung, but it maintains no persistent log of crash events and provides no access to the faulting module stack or exception code. It is useful for observing resource pressure that precedes a crash, not for examining a crash that has already occurred.
Go deeper
Related to this question
Learn chapter
DISM Tool for Windows Repair
Key term
Event Viewer
Event Viewer is a built-in Windows tool that logs system, security, and application events to help administrators monitor and troubleshoot issues.
Key term
Windows 10
Windows 10 is a personal computer operating system developed by Microsoft that combines the familiarity of Windows 7 with the modern features of Windows 8, designed to run on a wide range of devices from desktops to tablets.
About these practice questions
Courseiva writes every 220-1102 question from scratch — 925 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1102 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1102 exam.