200-201 Host-Based Analysis Practice Question
A security analyst is investigating a Windows host suspected of malware infection. Which tool would allow the analyst to view parent-child relationships of running processes and inspect command line arguments?
⚠ Common exam trap
The trap is confusing basic process listing tools (Task Manager, tasklist) with advanced forensic tools; candidates must remember that only Process Explorer (and similar tools like Process Hacker) shows both parent-child relationships and command-line arguments natively.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Process Explorer
Process Explorer, part of Microsoft Sysinternals, provides a hierarchical view of running processes, showing parent-child relationships and allowing inspection of command-line arguments via the process properties. It also offers advanced features like VirusTotal integration and handle/ DLL views, making it the ideal tool for this investigation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Process Explorer
Why this is correct
Process Explorer displays a live process tree, exposing parent-child relationships that reveal suspicious spawning, such as Office launching PowerShell. Its command-line column shows the exact arguments passed to each process, satisfying the investigation's requirement to inspect execution details on the suspect Windows host.
- ✗
Task Manager
Why it's wrong here
Task Manager lists running processes and can show parent process names, but it does not reliably expose full command line arguments or a navigable process tree. It is tempting as a built-in, familiar tool, yet Process Explorer or similar is needed for that depth.
- ✗
tasklist command
Why it's wrong here
tasklist enumerates running processes and can display parent process IDs, yet it does not render the parent-child hierarchy visually and omits command line arguments unless verbose switches are combined. It is tempting for quick process inventory on remote hosts, where simple enumeration suffices.
- ✗
Resource Monitor
Why it's wrong here
Resource Monitor shows per-process CPU, disk and network counters, but its process list exposes neither parent-child lineage nor full command line arguments. It is tempting because it does surface which processes are consuming resources, which suits general performance troubleshooting rather than malware lineage tracing.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.