200-201 Host-Based Analysis Practice Question
An analyst is reviewing logs on a Windows 10 host that is suspected of being compromised. The analyst runs 'wevtutil qe Security /q:"*[System[(EventID=4688)]]" /f:text' and sees that a process named 'powershell.exe' was launched by 'winword.exe' with the command line 'powershell -nop -w hidden -enc SQBFAFgA...'. Which type of malicious activity does this most likely indicate?
⚠ Common exam trap
The trap here is assuming that any PowerShell execution from Office is benign automation, overlooking the malicious flags and encoded command.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A macro-based document exploit spawning an encoded PowerShell payload
The parent-child relationship between winword.exe and powershell.exe with encoded, hidden arguments is a well-known indicator of a malicious macro exploit. Attackers often use Office documents to launch PowerShell stagers that download or execute further payloads. This pattern is commonly seen in phishing campaigns and is a key detection point for endpoint security tools.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A macro-based document exploit spawning an encoded PowerShell payload
Why this is correct
The parent process winword.exe launching an encoded, hidden PowerShell command is a classic sign of a malicious macro in an Office document executing a stager. The -enc flag indicates Base64-encoded commands, often used to obfuscate payloads. This combination is a strong indicator of a phishing document exploit leading to code execution.
- ✗
A user manually running a PowerShell script for administrative purposes
Why it's wrong here
Manual administrative use would typically involve a user opening a PowerShell console or running a script from a known location, not a hidden window with encoded commands spawned by Word. The -w hidden and -enc flags are strong indicators of malicious intent, not routine administration.
- ✗
A legitimate Office add-in that uses PowerShell for automation
Why it's wrong here
Legitimate Office add-ins rarely spawn PowerShell with hidden windows and encoded commands. Such behavior is atypical and would not be considered normal automation. The encoded payload and hidden execution are hallmarks of malware, not standard add-in functionality.
- ✗
A scheduled task created by Windows Update to install patches
Why it's wrong here
Windows Update tasks are typically launched by svchost.exe or TiWorker.exe, not winword.exe. The use of -nop -w hidden -enc is not characteristic of legitimate update mechanisms; these flags are used to evade detection. Therefore, this activity does not align with Windows Update behavior.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.