220-1102 Software Troubleshooting Practice Question
A user reports that a recently installed application crashes immediately after launch on a Windows 10 Pro workstation. The technician has verified the system meets the application's requirements and has reinstalled the application. Which built-in Windows tool should the technician use to view detailed error logs and identify the cause of the crash?
⚠ Common exam trap
It's easy for candidates to confuse Event Viewer with Task Manager or Resource Monitor because they associate crash troubleshooting with performance monitoring, but only Event Viewer provides the persistent, detailed error logs needed to diagnose the root cause of an application crash.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Event Viewer
Event Viewer is the correct tool because it logs detailed system, application, and error events. When an application crashes, Windows writes an error event (often with Event ID 1000 for application errors) to the Windows Logs > Application section, which includes faulting module, exception code, and stack trace information. This allows the technician to pinpoint the exact cause of the crash, such as a missing DLL or a compatibility issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Task Manager
Why it's wrong here
Task Manager displays currently running processes, CPU/memory/disk utilization, and lets you terminate unresponsive tasks, but it is a live snapshot tool with no access to the historical Event Logs. It only shows that the process is no longer running or "Not responding"; it never records the faulting module, exception code, or event ID that would explain the crash. With the "Details" tab you can set process priority or affinity, but you cannot retrieve the application's crash event data from Task Manager.
- ✗
Resource Monitor
Why it's wrong here
Resource Monitor drills into real-time per-process usage of CPU, memory, disk, and network, including response times and active TCP connections, but it contains no event log viewer. A just-crashed application's exit isn't recorded as a log entry in Resource Monitor; instead the Windows Error Reporting and Application logs capture that information. While Resource Monitor can help you spot the resource spike preceding a crash, the underlying crash event details and error IDs are only found in Event Viewer.
- ✓
Event Viewer
Why this is correct
Event Viewer (eventvwr.msc) is the authoritative Microsoft Management Console snap-in for reading the Application and System logs, where application shutdown events are logged as "Application Error" or ".NET Runtime" event IDs. The crash event record includes the faulting application name, faulting module, exception code (e.g., 0xc0000005), and the operating system version that generated the error, enabling a precise diagnosis. Custom views can filter for specific event IDs or sources to quickly isolate the recently installed application's crash.
- ✗
Performance Monitor
Why it's wrong here
Performance Monitor (perfmon.exe) collects and logs performance counters, such as % Processor Time, available memory, and .NET CLR exceptions, into counter logs or Data Collector Sets for later analysis, but it never captures crash stack traces or event records. You might see a spike in the "Exception Thrown" counter moments before the crash, but that counter only reveals a metric; the actual faulting-module and exception details are written to Event Viewer. Thus PerfMon is for trending and alerting, not for reading error logs.
Go deeper
Related to this question
Learn chapter
chkdsk Tool Usage
Key term
Event Viewer
Event Viewer is a built-in Windows tool that logs system, security, and application events to help administrators monitor and troubleshoot issues.
Key term
Windows 10
Windows 10 is a personal computer operating system developed by Microsoft that combines the familiarity of Windows 7 with the modern features of Windows 8, designed to run on a wide range of devices from desktops to tablets.
About these practice questions
Courseiva writes every 220-1102 question from scratch — 925 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1102 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1102 exam.