220-1102 Software Troubleshooting Practice Question
A user reports that a line-of-business application on Windows 10 Pro crashes immediately after launch with error code 0xc0000005 (Access Violation). The technician has already reinstalled the application, applied all Windows updates, and run both System File Checker (SFC) and the Deployment Imaging Service and Management Tool (DISM) with no issues found. Which of the following should the technician do NEXT to troubleshoot the crash?
⚠ Common exam trap
The trap here is that candidates often jump to Process Monitor or clean boot as a first troubleshooting step, but the CompTIA 220-1102 exam emphasizes checking Event Viewer logs early in the troubleshooting methodology because they provide immediate, structured error data without requiring additional tools or system changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check Event Viewer for system and application logs
Error code 0xc0000005 (Access Violation) indicates the application attempted to access memory it was not permitted to access. Since the technician has already reinstalled the app, applied updates, and verified system file integrity with SFC and DISM, the next logical step is to check Event Viewer for system and application logs. These logs often contain detailed error messages, faulting module names, or stack traces that pinpoint the root cause, such as a corrupted DLL, driver conflict, or permission issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Process Monitor to capture file and registry access during launch
Why it's wrong here
Process Monitor is less effective for diagnosing an immediate 0xc0000005 Access Violation crash, which typically signifies an in-memory error or conflict within the application's process space, rather than a file or registry access issue. The existing troubleshooting (reinstall, SFC, DISM) makes fundamental file or registry corruption unlikely. This tool is valuable for identifying missing files, incorrect registry permissions, or resource access failures that prevent an application from launching or functioning correctly, making it tempting for general startup problems where I/O operations are the root cause.
- ✓
Check Event Viewer for system and application logs
Why this is correct
Open Event Viewer and navigate to Windows Logs > Application. A crash caused by an access violation typically appears as an Error event with Event ID 1000, listing the faulting application, faulting module (e.g., a DLL), and the exception code 0xc0000005. This log entry directs you to the exact component at fault, making it the quickest and most precise diagnostic step before attempting broader fixes.
- ✗
Run CHKDSK to verify the integrity of the hard drive
Why it's wrong here
Running CHKDSK verifies the filesystem structure and scans for bad sectors, but the existing SFC and DISM scans already confirmed there is no system file or image corruption. An access violation (0xc0000005) occurs in process memory, not as a result of disk read/write failures, so checking disk integrity is unlikely to identify the root cause. This tool is appropriate for issues like file system errors or physical media failures, which are not indicated here.
- ✗
Perform a clean boot to eliminate software conflicts
Why it's wrong here
A clean boot disables all non-Microsoft services and startup entries to detect software conflicts, but it is a broad, time-consuming isolation procedure. Since Event Viewer can directly expose the faulting module and exception code from the crash log, you can pinpoint the cause without altering the system state. If Event Viewer shows a specific DLL or service involved, you can target that component directly instead of systematically toggling services.
Go deeper
Related to this question
Learn chapter
Windows Services Management
Key term
Integrity
Integrity is the assurance that data has not been altered or tampered with in an unauthorized way, preserving its accuracy and consistency from source to destination.
Key term
Windows 10
Windows 10 is a personal computer operating system developed by Microsoft that combines the familiarity of Windows 7 with the modern features of Windows 8, designed to run on a wide range of devices from desktops to tablets.
About these practice questions
This 220-1102 question is part of Courseiva's 925-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 220-1102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A user reports that a line-of-business application on Windows 10 crashes immediately after launch. The technician has already run System File Checker (SFC) and DISM, which found no corruption. The application was working correctly before a recent Windows Update. Which built-in tool should the technician use NEXT to identify the cause of the crash?
medium- A.Task Manager
- ✓ B.Event Viewer
- C.Performance Monitor
- D.Resource Monitor
Why B: Event Viewer (B) is the correct next step because it logs detailed application error events, including crash dumps and faulting module information. Since SFC and DISM found no system corruption, the crash is likely caused by a compatibility issue or a faulty update, and Event Viewer's Application or System logs will show the specific error code, module, and exception that caused the crash.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1102 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1102 exam.