220-1102 Software Troubleshooting Practice Question
A user reports that a Windows 10 application crashes with an error message when attempting to open a specific document. Other documents in the same application open without issue. Which built-in tool should the technician use FIRST to identify the cause of the crash?
⚠ Common exam trap
Test-takers frequently confuse a system-wide performance tool (Task Manager or Resource Monitor) with a diagnostic log viewer, overlooking that Event Viewer is the only tool that captures historical crash data for application-specific errors.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Event Viewer
Event Viewer is the correct first tool because it logs detailed application error events, including crash dumps, faulting module names, and exception codes. Since the crash is specific to one document, Event Viewer can reveal whether the fault lies in a corrupt file handler, a missing codec, or a document-specific trigger, rather than a system-wide issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Task Manager
Why it's wrong here
Task Manager (taskmgr.exe) provides a real-time snapshot of running processes, CPU, memory, disk, and network utilization. Its Processes and Details tabs show status flags such as 'Not responding,' but they do not expose the underlying exception code, faulting module, or Event ID that caused the crash. Because it only displays the current state and discards historical data after a process exits, it cannot serve as a log viewer for application crash diagnostics.
- ✗
System Configuration
Why it's wrong here
System Configuration (msconfig.exe) is a boot-and-startup utility that controls which operating system, services, and startup programs load at boot time. Its primary diagnostics use is enabling a 'clean boot' to isolate driver or service conflicts, but it has no access to the Windows Event Log or the error-reporting store. Troubleshooters might use it to prevent an app from launching at startup, yet it cannot reveal why that app crashed previously.
- ✓
Event Viewer
Why this is correct
Event Viewer (eventvwr.msc) is the Windows Management Console snap-in that directly reads the event logs, including the Application log where crash events are written as Error entries with Event ID 1000 or similar. A crash detail view includes the faulting module, exception code, and time stamp, making it the definitive source for diagnosing application failures. Unlike the other tools, Event Viewer retains historical events across sessions, so you can review a crash that happened hours or days ago.
- ✗
Resource Monitor
Why it's wrong here
Resource Monitor (resmon.exe) charts live per-process CPU, memory, disk, and network activity and can show thread stacks and per-process handles, but it is a live performance tool with no persistent event records. It does not integrate with the Event Log or Windows Error Reporting, so after a crashed process terminates, its identity and error details are lost from this view. Resource Monitor is useful for spotting a process that is pegging CPU, for example, but not for reading the crash log that explains why the app stopped.
Go deeper
Related to this question
Learn chapter
Linux File System Structure
Key term
Event
An event is any identifiable occurrence or action in a computer system, network, or application that can be logged, monitored, or analyzed for security or operational purposes.
Key term
Windows
Windows is a family of operating systems developed by Microsoft that manages computer hardware and software, providing a graphical user interface for users to interact with their devices.
About these practice questions
One of 925 original 220-1102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1102 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1102 exam.