200-201 Host-Based Analysis Practice Question
An analyst finds an unknown scheduled task on a Windows system that runs a PowerShell script at system startup. Which tool is best for examining the task's trigger and actions?
⚠ Common exam trap
The trap is assuming Event Viewer or Registry Editor is sufficient because they can show evidence a task ran; the question asks specifically for examining the task's trigger and actions, which only Task Scheduler presents directly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Task Scheduler
Task Scheduler is the native Windows tool that displays scheduled tasks along with their triggers (e.g., 'At system startup') and actions (e.g., running a PowerShell script). It provides a GUI and command-line interface (schtasks) to inspect, modify, or disable suspicious tasks, making it the best fit for examining the task's configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Services.msc
Why it's wrong here
Services.msc manages Windows services and their startup types, not scheduled tasks; Task Scheduler is the console exposing a task's triggers, actions and conditions. It tempts analysts because both control startup behaviour, but a scheduled task is not a service and will not appear there.
- ✗
Event Viewer
Why it's wrong here
Event Viewer displays recorded events, not task configuration; Task Scheduler shows the trigger, action and author directly. It tempts analysts because scheduled-task execution generates event log entries, but those entries reveal that a task ran, not what its trigger and action are.
- ✗
Registry Editor
Why it's wrong here
Registry Editor exposes static Run/RunOnce keys, not Task Scheduler's XML definitions, so it cannot show the task's trigger or action. It is tempting because malware persistence often hides in registry autorun locations, making it the right tool when investigating those keys rather than scheduled tasks.
- ✓
Task Scheduler
Why this is correct
Task Scheduler exposes each task's triggers, actions, conditions and author, letting the analyst inspect exactly what the PowerShell script runs and when. Other tools show process or file artefacts but not the task definition itself.
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.