200-201 Host-Based Analysis Practice Question
An analyst is investigating a Windows host and observes a suspicious process with PID 1337. Which THREE of the following Volatility commands would provide useful information about this process? (Choose three.)
⚠ Common exam trap
Cisco often tests the distinction between process-specific plugins (like `cmdline`, `dlllist`, `pslist`) and system-wide or network plugins (like `hivelist`, `connscan`), leading candidates to select plugins that are useful for general analysis but not directly for investigating a specific process.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
cmdline
The `cmdline` plugin displays the command-line arguments used to start a process, which is critical for identifying malicious or suspicious execution patterns (e.g., obfuscated paths, encoded commands). For PID 1337, this reveals exactly how the process was launched, helping to confirm or refute malicious intent.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
cmdline
Why this is correct
Correct. Shows command-line arguments for the process.
- ✗
hivelist
Why it's wrong here
hivelist lists registry hives, not process-specific.
- ✓
pslist
Why this is correct
Correct. Lists all processes with PIDs.
- ✗
connscan
Why it's wrong here
connscan scans for network connections, not process-specific info.
- ✓
dlllist
Why this is correct
Correct. Lists DLLs loaded by the process.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.