hardMultiple ChoiceObjective-mapped
200-201 Practice Question: Based on the exhibit, what does the sequence of…
Exhibit
Refer to the exhibit. Event 4688 (Process Creation): New Process ID: 0x1234 New Process Name: C:\Users\Public\svchost.exe Creator Process ID: 0x9ABC Creator Process Name: C:\Windows\System32\wmiprvse.exe Process Command Line: svchost.exe -k ntsvcs Event 4688 (Process Creation): New Process ID: 0x5678 New Process Name: C:\Windows\System32\svchost.exe Creator Process ID: 0x1234 Creator Process Name: C:\Users\Public\svchost.exe Process Command Line: C:\Windows\System32\calc.exe
Based on the exhibit, what does the sequence of events indicate?
⚠ Common exam trap
Cisco often tests the misconception that svchost.exe is always legitimate and that wmiprvse.exe only spawns itself or system processes, when in fact attackers can use WMI to launch arbitrary executables with a misleading name.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A process masquerading as svchost.exe was spawned by wmiprvse.exe (likely via WMI), and then that malicious process launched calc.exe, a suspicious behavior.
The exhibit shows wmiprvse.exe (the WMI Provider Host) spawning svchost.exe, which then launches calc.exe. In normal operations, wmiprvse.exe does not spawn svchost.exe; svchost.exe is a generic host process for Windows services and is typically launched by services.exe. The sequence indicates process masquerading: an attacker used WMI to execute a malicious binary named svchost.exe, which then launched calc.exe as a suspicious payload. This is a classic indicator of lateral movement or privilege escalation via WMI.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The wmiprvse.exe process is known to spawn svchost.exe for system health checks.
Why it's wrong here
Wmiprvse does not normally spawn svchost.exe into Public folder.
- ✓
A process masquerading as svchost.exe was spawned by wmiprvse.exe (likely via WMI), and then that malicious process launched calc.exe, a suspicious behavior.
Why this is correct
The path and subsequent execution of calc.exe indicate malicious activity.
- ✗
The user is executing a macro that opens Calculator.
Why it's wrong here
No macro involvement is indicated; the process chain is automated.
- ✗
A legitimate system process (wmiprvse.exe) launched a service host, which then launched calc.exe for maintenance.
Why it's wrong here
The svchost.exe in Public is not legitimate.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.