220-1102 Software Troubleshooting Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Task Manager

  Why it's wrong here

  Task Manager's Performance tab shows real-time memory usage, including total RAM in use, available memory, and per-process working sets, but it only reads the OS's memory counters. It never writes test patterns to DRAM or reads them back to verify hardware integrity, so it can indicate memory pressure but cannot confirm or rule out a faulty RAM module. This is why the 0xC0000005 access violation, which can stem from hardware memory corruption, cannot be diagnosed with Task Manager.

• ✗

  Performance Monitor

  Why it's wrong here

  Performance Monitor (perfmon.exe) collects performance counters like Memory\Available Bytes and Pages/sec over time, allowing you to correlate the crash with memory trends or paging activity. It is a logging and analysis tool, not a hardware verification tool; it cannot probe physical memory locations or execute the read/write/refresh tests that reveal failing cells. Even if it shows a growing pool or high page fault rate, it cannot prove that a specific DRAM cell is corrupted, so it is not a valid diagnostic for this error.

• ✓

  Windows Memory Diagnostic

  Why this is correct

  Windows Memory Diagnostic (mdsched.exe) reboots the computer into a pre-boot environment and performs a series of low-level memory tests, including MATS+, INVC, SCHCKR, stride-based address patterns, and cache tests that write and read bit patterns across the entire address space. When it detects a failing memory cell, it logs the error in the Event Log under MemoryDiagnostics-Results, which directly explains a 0xC0000005 access violation caused by corrupted data. Because 0xC0000005 is a memory access violation, this tool is the appropriate first-line choice to confirm hardware-level RAM failure.

• ✗

  Resource Monitor

  Why it's wrong here

  Resource Monitor (resmon.exe) provides a live, detailed breakdown of physical memory, including hardware used, committed, cached, and the per-process standby list, and it can even show which processes hold specific memory segments. However, it has no ability to generate synthetic loads or run diagnostic algorithms against the memory controller; it simply mirrors the current state of the memory manager. Its role is limited to observing symptoms, such as a process ballooning in memory, but it cannot substantiate that the RAM chips themselves are defective, which is required to validate a hardware-related crash.

Go deeper

Related to this question