220-1102 Software Troubleshooting Practice Question
A Windows 10 workstation crashes intermittently with a blue screen error SYSTEM_SERVICE_EXCEPTION. The crashes often occur when using a specific third-party application. The technician has updated the application, run System File Checker and DISM with no issues. Which built-in tool should the technician use to analyze the memory dump files generated by the crashes?
⚠ Common exam trap
A common mix-up: candidates choose Event Viewer because they associate it with error logs, but they overlook that Reliability Monitor is specifically designed to present crash dump analysis in a more accessible, application-focused timeline.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reliability Monitor
Reliability Monitor is the correct tool because it provides a user-friendly, timeline-based view of system stability, including detailed information about blue screen errors and their associated memory dump files. Unlike Event Viewer, it aggregates crash data with application-specific context, making it ideal for correlating the SYSTEM_SERVICE_EXCEPTION with the third-party application.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Event Viewer
Why it's wrong here
Event Viewer does contain the underlying BugCheck events (Event ID 1001) and system error entries for a blue screen, but it presents them as a flat, uncorrelated list of log entries. To troubleshoot intermittent crashes, you would have to manually filter by time and Event ID and then cross-reference minidump paths and faulting modules. Reliability Monitor, by contrast, automatically aggregates these same events onto a visual timeline, making it far more convenient for spotting recurring blue-screen patterns.
- ✗
Performance Monitor
Why it's wrong here
Performance Monitor is designed for real-time and logged performance metrics such as CPU usage, memory pressure, disk activity, and network throughput. It can help identify resource bottlenecks or trending performance issues that might indirectly contribute to instability, but it has no mechanism for reading or interpreting crash dump files. Because it never touches the .dmp files or BugCheck event details, it cannot reveal the faulting driver or module responsible for a blue screen.
- ✓
Reliability Monitor
Why this is correct
Reliability Monitor is the correct choice because it presents a time-stamped stability history and flags every blue-screen incident with a red X, along with the specific failure details. For each crash, it shows the date, the faulting module, and a link to the associated minidump file, allowing you to see whether the same driver or component is responsible across intermittent events. Its stability index over time also makes it easy to determine whether crashes began after a particular software installation or driver update.
- ✗
Windows Memory Diagnostic
Why it's wrong here
Windows Memory Diagnostic is a pre-boot utility, launched via mdsched.exe, that runs a series of memory tests to detect faulty RAM modules. While RAM defects can indeed cause intermittent blue screens, this tool does not examine or analyze existing crash dump files or reveal which driver triggered a specific bugcheck. It is a root-cause test for one possible hardware cause, not a log-review tool for past crash events.
Go deeper
Related to this question
Learn chapter
DISM Tool for Windows Repair
Key term
Windows 10
Windows 10 is a personal computer operating system developed by Microsoft that combines the familiarity of Windows 7 with the modern features of Windows 8, designed to run on a wide range of devices from desktops to tablets.
Key term
Event
An event is any identifiable occurrence or action in a computer system, network, or application that can be logged, monitored, or analyzed for security or operational purposes.
About these practice questions
This 220-1102 question is part of Courseiva's 925-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1102 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1102 exam.