220-1102 Software Troubleshooting Practice Question
A Windows 10 workstation consistently displays a stop error: SYSTEM_SERVICE_EXCEPTION (win32kbase.sys). The crash occurs when the user logs off. The technician has updated all graphics and chipset drivers and run SFC /scannow without finding any issues. What is the most likely cause?
⚠ Common exam trap
Candidates often assume a stop error with a graphics-related module (win32kbase.sys) must be a driver or hardware issue, overlooking that third-party shell extensions can also crash the graphics subsystem during session transitions like logoff.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Incompatible third-party shell extension
The crash occurs specifically during logoff, and the faulting module is win32kbase.sys, which is a core graphics driver component. Since SFC /scannow found no system file corruption and graphics/chipset drivers are updated, the most likely cause is an incompatible third-party shell extension that loads during the logoff process, triggering the SYSTEM_SERVICE_EXCEPTION. Shell extensions (e.g., context menu handlers, icon overlays) run in the Explorer process and can cause crashes when they interact improperly with the graphics subsystem during session transitions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Corrupted user profile
Why it's wrong here
A corrupted user profile generally causes logon-time failures, such as loading a temporary profile, or application crashes when reading per-user registry hives. It would not consistently produce a system stop error referencing win32kbase.sys, which is a kernel-mode graphics driver component. The crash timing during logoff instead points to a component unloading operation, not profile data corruption.
- ✗
Faulty RAM modules
Why it's wrong here
Faulty RAM can generate a wide range of stop errors, but they are typically random in terms of both timing and the specific bug check code. A stop error that consistently occurs during logoff with a file reference to win32kbase.sys is deterministic, indicating a software routine that runs at that point. Memory errors also tend to produce PAGE_FAULT_IN_NONPAGED_AREA or various IRQL errors, not a repeatable graphics subsystem crash.
- ✓
Incompatible third-party shell extension
Why this is correct
Third-party shell extensions, such as those installed by archive utilities or antivirus integration, are loaded into the Explorer process and can interact with graphics APIs during logoff. When the shell is unloading, a buggy extension can call into win32kbase.sys incorrectly, triggering the stop error on every logout because the faulty code path is always executed. Testing with a clean boot or disabling shell extensions can confirm the cause.
- ✗
Outdated BIOS/UEFI firmware
Why it's wrong here
BIOS/UEFI firmware updates address hardware compatibility, power management, and boot-level bugs, not issues with a kernel-mode graphics component like win32kbase.sys that fires only during logoff. A firmware problem would typically cause system instability across many operations or during boot, rather than a predictable stop error in a software unload routine. This issue is software-specific and therefore not resolved by a firmware update.
Go deeper
Related to this question
Learn chapter
Troubleshoot: Application Crashes
Key term
Shell
A shell is a computer program that provides a user interface to access an operating system's services, typically by accepting text commands.
Key term
Windows 10
Windows 10 is a personal computer operating system developed by Microsoft that combines the familiarity of Windows 7 with the modern features of Windows 8, designed to run on a wide range of devices from desktops to tablets.
About these practice questions
One of 925 original 220-1102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1102 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1102 exam.