200-201 Host-Based Analysis Practice Question
During a host-based analysis, a Windows system is found to have a suspicious service that starts automatically. Which command-line tool can be used to query the status and configuration of services, particularly to identify non-standard service names or paths?
⚠ Common exam trap
The trap is confusing service enumeration (sc query) with process-to-service mapping (tasklist /svc) or GUI tools (services.msc) — candidates pick tasklist /svc because it shows services, but it lacks configuration details like binary path.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
sc query
The 'sc query' command queries the Service Control Manager for service status and configuration, and with 'sc qc' it reveals the binary path, start type, and service account — exactly what's needed to spot non-standard service names or paths. It works from the command line, making it suitable for scripted forensic triage. Analysts use 'sc query state= all' to enumerate all services and 'sc qc <name>' to inspect suspicious ones.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
sc query
Why this is correct
The sc query command interrogates the Windows Service Control Manager, returning each service's status, start type and binary path. This directly satisfies the need to spot non-standard service names or executable paths during host-based analysis, since the SCM holds the authoritative configuration.
- ✗
services.msc
Why it's wrong here
services.msc launches the graphical Services console, not a command-line tool, so it fails the stem's requirement for command-line querying during host-based analysis. It tempts because it displays service status, startup type and binary path, making it the natural choice when interactive GUI access to the host is available.
- ✗
tasklist /svc
Why it's wrong here
tasklist /svc maps running processes to the services hosted inside them, but it reports neither startup type nor binary path, so an auto-starting suspicious service cannot be identified from it. It tempts because it is command-line and service-aware, yet it suits live process-to-service correlation, not configuration auditing.
- ✗
net start
Why it's wrong here
net start lists only running services and can start or stop them; it cannot display binary paths, startup configuration or non-standard service names, so suspicious paths stay hidden. It tempts because it is a genuine command-line service tool, but it is the correct choice for controlling services, not auditing their configuration.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.