Examkin

Question

Difficulty: HardTroubleshooting Windows Performance and Application Crashes

A systems administrator is troubleshooting a Windows 11 workstation where a background line-of-business service crashes every morning at 08:00 AM. Event Viewer displays Event ID 1000 in the Application log with faulting module `ntdll.dll` and exception code `0xc0000005`. Concurrently, Performance Monitor metrics show that the system's non-paged pool memory continuously increases throughout the morning until the crash occurs, while paged pool memory remains stable. Which of the following is the most likely cause of this performance degradation and application crash, and what is the most appropriate action to isolate it?

  1. A kernel-mode device driver memory leak is consuming non-paged pool resources; identify recently updated drivers using Driver Verifier or review system driver updates.Answer
  2. B
    The `ntdll.dll` system file is corrupted; execute `sfc /scannow` from an elevated Command Prompt to restore the damaged system library.
  3. C
    The virtual memory paging file size is misconfigured; open System Properties and increase the maximum pagefile allocation to prevent pool exhaustion.
  4. D
    The application architecture is incompatible with 64-bit Windows; adjust the shortcut execution settings to launch in Windows 8 compatibility mode.

Answer

The issue is caused by a kernel-mode driver memory leak consuming non-paged pool RAM, which should be isolated by inspecting recent driver updates or utilizing Driver Verifier.
Non-paged pool memory allocations are reserved for the Windows kernel and third-party device drivers. Because this memory cannot be paged to disk, a driver memory leak will continuously consume physical RAM until system memory resources are exhausted, triggering access violation exceptions (`0xc0000005`) in low-level API libraries like `ntdll.dll`. Diagnosing drivers via Driver Verifier or rollback of recently updated drivers is the correct isolation strategy.

Step-by-Step Solution

1
Analyze Performance Monitor memory metrics.
Identify that non-paged pool usage is steadily increasing over time without being released.
Non-paged pool memory is dedicated to the Windows kernel and hardware device drivers. Unlike user-mode memory or paged pool, non-paged pool RAM MUST remain in physical RAM and cannot be moved to `pagefile.sys`.
2
Correlate non-paged pool leak with the application crash symptom.
Recognize that memory pool exhaustion eventually deprives critical subsystem libraries like `ntdll.dll` of memory allocations, leading to access violation crashes (`0xc0000005`).
`ntdll.dll` is the central user-mode entry point to the Windows kernel. When kernel memory pools are depleted, calls passing through `ntdll.dll` fail catastrophically.
3
Select the correct isolation tool and remediation path.
Use tools targeted at kernel drivers (such as PoolMon, Driver Verifier, or reviewing recent driver updates) rather than user-mode application compatibility tweaks or pagefile modifications.
Resolving driver memory leaks requires identifying the specific kernel module leaking resources.

Key Concept

Windows Memory Pool Troubleshooting and Event Log Analysis
Rate this question

Topics

Troubleshooting Windows Performance and Application Crashes

More questions from this topic