200-201 Host-Based Analysis Practice Question
A security analyst is examining a Windows 10 host that is suspected of being compromised. The analyst runs `wmic process get name,processid,executablepath,commandline` and notices a process named `svchost.exe` with an executable path of `C:\Users\Public\svchost.exe`. Which conclusion is most accurate?
⚠ Common exam trap
The trap here is trusting the process name and assuming it is legitimate, when the executable path is the key indicator of masquerading.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The process is likely malware masquerading as svchost.exe.
Legitimate svchost.exe always runs from %SystemRoot%\System32\svchost.exe. An instance with an executable path in C:\Users\Public is almost certainly malware masquerading as a system process. Attackers use this technique to blend in with normal system activity. Analysts should verify the digital signature, parent process, and loaded modules to confirm maliciousness.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The process is a legitimate svchost.exe because the name matches the system process.
Why it's wrong here
Process names can be easily spoofed by malware. Trusting the name alone is a common mistake. The executable path is a critical differentiator: legitimate svchost.exe runs from System32, not from C:\Users\Public. Therefore, the name match does not validate legitimacy; the path indicates compromise.
- ✗
The process is a legitimate svchost.exe running from a non-standard location due to a Windows update.
Why it's wrong here
Legitimate svchost.exe processes always run from %SystemRoot%\System32\svchost.exe. Windows updates do not change this path. A svchost.exe running from C:\Users\Public is highly suspicious and indicates malware masquerading as a system process. The non-standard path is a red flag, not a benign anomaly.
- ✓
The process is likely malware masquerading as svchost.exe.
Why this is correct
Legitimate svchost.exe processes reside in %SystemRoot%\System32. An instance running from C:\Users\Public is a strong indicator of malware, as attackers often name their binaries after system processes and place them in user-writable directories to evade detection. The analyst should investigate further, such as checking digital signatures and parent process.
- ✗
The process is likely a legitimate svchost.exe that was copied to the Public folder by a user.
Why it's wrong here
Even if a user copied svchost.exe to the Public folder, running it from there would not be normal behavior. Legitimate svchost.exe is a service host that loads DLLs and is launched by services.exe from System32. Running it from a user-writable directory is a common malware tactic. This option incorrectly assumes benign user action.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.