Examkin

Question

Difficulty: HardTroubleshooting Windows Performance and Application Crashes

A technician is troubleshooting a legacy line-of-business application on a Windows 11 workstation. The application crashes immediately upon startup for standard domain users with exception code 0xc0000005 (Access Violation), but it launches and runs properly when logged in as a local administrator. Event Viewer logs confirm an Application Error (Event ID 1000) indicating that the process failed while attempting to create a log file inside `C:\Program Files\LegacyVendorApp\Logs`. Which of the following is the most appropriate action to resolve the crash while adhering to the principle of least privilege?

  1. Grant standard users Modify permissions specifically to the `C:\Program Files\LegacyVendorApp\Logs` folder.Answer
  2. B
    Add the standard domain user account to the local Administrators group on the workstation.
  3. C
    Execute `sfc /scannow` from an elevated Command Prompt to repair the application's executable files.
  4. D
    Open Event Viewer and clear the Windows Logs > Application log to reset the crash state.

Answer

Grant standard users Modify permissions specifically to the application's working log folder (`C:\Program Files\LegacyVendorApp\Logs`).
The exception code 0xc0000005 indicates an Access Violation, which occurs when a process attempts to read or write to a memory or storage location to which it does not have permission. Because standard users do not have Write/Modify permissions in `C:\Program Files` by default, adjusting NTFS security permissions on the specific `Logs` subfolder grants the necessary access without compromising the security of the rest of the application files or the system.

Step-by-Step Solution

1
Analyze the crash symptoms and diagnostic indicators in Event Viewer.
Event ID 1000 with exception code 0xc0000005 (Access Violation) combined with successful execution under an Administrator account confirms a privilege/permission restriction during file creation in `C:\Program Files\LegacyVendorApp\Logs`.
By default, standard users have Read & Execute access to `C:\Program Files`, but lack Write permissions.
2
Evaluate potential remediation options against security governance standards.
Granting Modify permissions to only the `Logs` directory addresses the application's requirement while maintaining security controls on all executable files in the root folder.
Applying targeted NTFS permissions upholds the principle of least privilege instead of granting standard users broad local administrator rights.

Key Concept

Troubleshooting Application Crashes and NTFS Permission Restrictions
Estimated Time:2m 0s
Rate this question

Topics

Troubleshooting Windows Performance and Application Crashes

More questions from this topic