200-201 Host-Based Analysis Practice Question
A security analyst is triaging a Windows server that may have been compromised. The analyst needs to identify which network connections are currently established by processes on the host and which executable is responsible for each connection. Which two native tools provide this information? (Choose two.)
⚠ Common exam trap
The trap here is reaching for configuration tools such as ipconfig or route print, which describe the host's network setup rather than its live connections and owning processes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Get-NetTCPConnection -State Established
Mapping active connections to the processes that own them requires tools that expose both socket state and the owning PID. netstat with the -a, -n, and -o switches reports all connections numerically with the PID, while the Get-NetTCPConnection cmdlet returns objects whose OwningProcess property carries the same identifier. Either output can then be joined with a process listing to name the responsible executable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ipconfig /all
Why it's wrong here
ipconfig /all displays adapter configuration such as IP addresses, DNS servers, MAC addresses, and DHCP lease details. It reports the host's own network settings but contains no information about active connections or the processes that own them, so it cannot help identify which executable is communicating.
- ✗
arp -a
Why it's wrong here
arp -a displays the ARP cache, mapping IP addresses to MAC addresses on the local subnet. It can hint at other hosts the machine recently contacted, but it provides no port, protocol, or process information, so it cannot attribute an established connection to a specific executable.
- ✓
Get-NetTCPConnection -State Established
Why this is correct
Get-NetTCPConnection is a PowerShell cmdlet that returns TCP connection objects, and its OwningProcess property gives the PID responsible for each connection. Filtering on the Established state focuses the output on active sessions and makes it straightforward to correlate them with process information.
- ✗
route print
Why it's wrong here
route print shows the local routing table, including destination networks, gateways, and interface metrics. It is useful for understanding how traffic leaves the host, but it does not enumerate established connections or associate any socket with a process, so it cannot reveal the executable behind a suspicious connection.
- ✓
netstat -ano
Why this is correct
netstat -ano lists active connections with the owning process ID in the final column. Combining that PID with a process listing lets the analyst map each connection to its executable, which is essential for spotting a suspicious process beaconing to an external address during triage.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.