mediumMultiple ChoiceObjective-mapped
Backdoor Detection Using Network and Process Analysis
Exhibit
Refer to the exhibit. From a Windows host, the analyst runs: C:\> netstat -ano | findstr 4444 Output: TCP 192.168.1.100:49201 203.0.113.5:4444 ESTABLISHED 1234 UDP 0.0.0.0:4444 *:* 5678 The analyst also runs: C:\> tasklist | findstr 1234 cmd.exe 1234 Console 1 2,048 K C:\> tasklist | findstr 5678 svchost.exe 5678 Services 0 1,024 K
Based on the exhibit, what is the most likely conclusion about the host's security state?
Quick Answer
The correct conclusion is that the host has a backdoor listening on UDP port 4444 with an active command session via cmd.exe. This is because svchost.exe should never bind to a raw UDP listener—it normally hosts Windows services over TCP or named pipes—so its appearance on UDP port 4444 is a strong anomaly. The established TCP connection to 203.0.113.5 with cmd.exe as the associated process confirms an active remote command shell, which is the hallmark of a backdoor providing remote execution. On the Cisco CyberOps Associate 200-201 exam, this scenario tests your ability to identify backdoors via network connections and process analysis, a core skill for detecting compromised hosts. A common trap is assuming svchost.exe is always benign; remember that attackers often masquerade malicious processes under trusted names. Memory tip: “UDP on svchost is a ghost in the host.”
⚠ Common exam trap
Cisco often tests the misconception that svchost.exe is always legitimate, but the trap here is that a UDP listener on port 4444 combined with an established cmd.exe connection is a definitive indicator of a backdoor, not a normal Windows service or remote admin tool.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The host has a backdoor listening on UDP port 4444, and the established connection suggests an active command session via cmd.exe.
The exhibit shows svchost.exe listening on UDP port 4444, which is abnormal because svchost.exe typically hosts Windows services over TCP or named pipes, not raw UDP. Additionally, an established TCP connection to 203.0.113.5 with cmd.exe as the associated process indicates an active command shell session, which is a classic sign of a backdoor. Therefore, option D is correct. Option A is incorrect because UDP port 4444 is not a standard Windows service port. Option B is incorrect because there is no direct evidence of data exfiltration; the connection is consistent with a remote shell. Option C is incorrect because legitimate remote admin tools do not typically use svchost.exe on UDP port 4444 with cmd.exe.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The svchost.exe process on UDP port 4444 indicates a Windows service that should be monitored.
Why it's wrong here
svchost.exe in the Services session is normal, but the context of port 4444 is unusual.
- ✗
The established TCP connection to 203.0.113.5 indicates data exfiltration to a known malicious IP.
Why it's wrong here
While possible, the IP is not known to be malicious; the backdoor scenario is more likely based on the evidence.
- ✗
The host is running a legitimate remote administration tool on port 4444.
Why it's wrong here
No legitimate common service uses port 4444 from cmd.exe.
- ✓
The host has a backdoor listening on UDP port 4444, and the established connection suggests an active command session via cmd.exe.
Why this is correct
The combination of UDP listener and cmd.exe connection to external IP is highly suspicious.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-201
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. A security analyst is analyzing a Windows host that is communicating with an external server at 192.168.1.50. Based on the output, which process is likely malicious?
hard- A.svchost.exe (PID 1420) because it is connecting to an external IP on port 80.
- B.cmd.exe (PID 2568) because it could be used to launch other processes.
- ✓ C.powershell.exe (PID 2792) because it has an established HTTPS connection to an external server.
- D.notepad.exe (PID 2344) because it is not expecting to make any network connections.
Why C: PowerShell.exe (PID 2792) is the likely malicious process because it has an established HTTPS connection (TCP port 443) to an external server at 192.168.1.50. PowerShell is a powerful scripting tool often abused by attackers to execute arbitrary code, download payloads, or establish command-and-control (C2) channels over encrypted HTTPS, which can evade detection by traditional signature-based security tools.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.