Core 2 Domain 3: Software Troubleshooting (23%)¶

Overview¶

Software Troubleshooting is the Core 2 twin of Core 1 Domain 5. Every objective is "Given a scenario, troubleshoot..." with a list of symptoms. Your job is to match the symptom to the most likely cause and the least disruptive fix that works. The tools come from 06 - Operating Systems, and the security fixes come from 07 - Security.

The objectives are:

• 3.1 Given a scenario, troubleshoot common Windows OS issues.
• 3.2 Given a scenario, troubleshoot common mobile OS and application issues.
• 3.3 Given a scenario, troubleshoot common mobile OS and application security issues.
• 3.4 Given a scenario, troubleshoot common PC security issues.

A Repair Ladder for Windows¶

When the question asks for the best or first fix, pick the least destructive option that addresses the cause. This ladder runs from gentle to drastic:

flowchart TB
    A["Restart the app, service, or PC"] --> B["Check Event Viewer and Reliability Monitor"]
    B --> C["Update, roll back, or reinstall the driver or app"]
    C --> D["Run sfc /scannow and DISM"]
    D --> E["Boot to Safe Mode, clean boot with msconfig"]
    E --> F["System Restore to a known good point"]
    F --> G["Startup Repair or uninstall the last update in Windows RE"]
    G --> H["Reset this PC (keep files) or repair install"]
    H --> I["Reimage / clean install from backup"]

A typical escalation from the least to the most disruptive Windows fix. Always back up data before the lower rungs.

📖 Windows Recovery Environment (Windows RE) - Startup Repair, System Restore, and reset options

3.1 Windows OS Issues¶

Useful tools for 3.1¶

3.2 Mobile OS and Application Issues¶

Escalation for mobile: restart, update, clear cache/data, reinstall the app, reset network settings, then factory reset (after backup) as a last resort.

3.3 Mobile OS and Application Security Issues¶

Security concerns¶

Common symptoms¶

Response¶

1. Check installed apps and remove unknown or recently installed ones.
2. Check for unknown configuration profiles, VPNs, or device admin apps (Android) and remove them.
3. Run a mobile security scan.
4. Update the OS and apps.
5. Change passwords for accounts used on the device, from a clean device.
6. If still compromised, back up data (not apps) and factory reset.
7. Report to IT or security if it is a corporate device, so MDM can check other devices.

3.4 PC Security Issues¶

Common symptoms¶

Browser-related symptoms¶

flowchart LR
    S["Security symptom on a PC"] --> Q{"Files renamed<br/>or encrypted?"}
    Q -->|Yes| R["Treat as ransomware:<br/>isolate immediately, escalate,<br/>restore from backup"]
    Q -->|No| B{"Browser only?"}
    B -->|Yes| BR["Remove extensions, reset browser,<br/>check hosts file, DNS, proxy"]
    B -->|No| M["Follow the 10-step<br/>malware removal procedure"]

A quick triage for PC security symptoms: ransomware gets isolated and escalated at once, browser-only problems usually clear with an extension and settings cleanup, and anything else follows the full removal procedure.

Certificate warnings deserve extra care. Check the system date and time first. A clock set years in the past makes every certificate look invalid. If the time is right, treat it as a possible interception and do not click through.

The full removal procedure is in 07 - Security.

Exam Tips and Traps¶

1. BSOD after a driver update - Safe Mode, then roll back the driver.
2. Problem gone in Safe Mode - a third-party driver or startup item is the cause. Use a clean boot to find it.
3. Something changed yesterday - Reliability Monitor, then System Restore.
4. sfc /scannow for corrupted system files. DISM repairs the image SFC uses.
5. No OS found - check for a USB stick left in, then boot order and mode.
6. Slow profile load - roaming profile or unreachable mapped drives.
7. Time drift - NTP or CMOS battery. Kerberos fails if the clock is off.
8. Mobile app keeps crashing - update, clear cache, reinstall, before factory reset.
9. Jailbroken or rooted device - MDM blocks it, remove from corporate access.
10. Fake antivirus alert - scareware. Do not click. Follow malware removal steps.
11. Renamed files you cannot open - ransomware. Isolate first.
12. Certificate warnings on every site - check the system clock.

Related Notes¶

• 06 - Operating Systems - The tools used in this note
• 07 - Security - Malware types and removal steps
• 05 - Hardware and Network Troubleshooting - The hardware side of troubleshooting