hardMultiple ChoiceObjective-mapped
200-201 Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit. C:\Users\Admin> tasklist /svc Image Name PID Services ========================= ======== ============================================ svchost.exe 1236 BrokerInfrastructure, DcomLaunch, PlugPlay svchost.exe 1420 RpcSs, LanmanWorkstation, Dhcp, NlaSvc svchost.exe 1508 WpnService, WpnUserService notepad.exe 2344 N/A cmd.exe 2568 N/A powershell.exe 2792 N/A C:\Users\Admin> netstat -anob | findstr 192.168.1.50 TCP 192.168.1.100:49152 192.168.1.50:443 ESTABLISHED 2792 TCP 192.168.1.100:49153 192.168.1.50:80 ESTABLISHED 1420
Refer to the exhibit. A security analyst is analyzing a Windows host that is communicating with an external server at 192.168.1.50. Based on the output, which process is likely malicious?
⚠ Common exam trap
Cisco often tests the misconception that any process connecting to an external IP is malicious, but the trap here is that candidates overlook the context of the process—PowerShell is a legitimate tool that is frequently abused, whereas svchost.exe making HTTP connections is normal system behavior.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
powershell.exe (PID 2792) because it has an established HTTPS connection to an external server.
PowerShell.exe (PID 2792) is the likely malicious process because it has an established HTTPS connection (TCP port 443) to an external server at 192.168.1.50. PowerShell is a powerful scripting tool often abused by attackers to execute arbitrary code, download payloads, or establish command-and-control (C2) channels over encrypted HTTPS, which can evade detection by traditional signature-based security tools.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
svchost.exe (PID 1420) because it is connecting to an external IP on port 80.
Why it's wrong here
svchost.exe commonly hosts services that make HTTP connections; this alone is not suspicious.
- ✗
cmd.exe (PID 2568) because it could be used to launch other processes.
Why it's wrong here
Cmd.exe has no network connections; it is not directly communicating.
- ✓
powershell.exe (PID 2792) because it has an established HTTPS connection to an external server.
Why this is correct
PowerShell making an outbound HTTPS connection is atypical and often used for malicious purposes.
- ✗
notepad.exe (PID 2344) because it is not expecting to make any network connections.
Why it's wrong here
Notepad.exe has no network connections in the output, so it is not involved.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.