easyMultiple ChoiceObjective-mapped
200-201 Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit. ``` C:\Users\admin>tasklist /SVC Image Name PID Services ========================= ======== ============================================ svchost.exe 1240 DcomLaunch, LSM svchost.exe 1500 BrokerInfrastructure, gpsvc, ProfSvc svchost.exe 1780 Schedule svchost.exe 1972 Themes svchost.exe 2100 WlanSvc notmalware.exe 2300 No services are associated with this image. ```
Refer to the exhibit. An analyst runs tasklist /SVC on a suspected host. Which process is most suspicious?
⚠ Common exam trap
Cisco often tests the misconception that multiple svchost.exe processes are inherently suspicious, when in fact Windows normally runs many svchost instances, and the real red flag is a process with a clearly fabricated name like 'notmalware.exe'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
notmalware.exe with PID 2300
'notmalware.exe' is a deliberately suspicious process name that does not correspond to any legitimate Windows system binary. The tasklist /SVC command displays processes and their associated services; a process named 'notmalware.exe' is a clear indicator of potential malware attempting to disguise itself with an ironic name, whereas svchost.exe is a legitimate Windows host process for services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
svchost.exe with PID 1500
Why it's wrong here
Another legitimate svchost.
- ✗
svchost.exe with PID 1240
Why it's wrong here
svchost is legitimate; it hosts multiple services.
- ✓
notmalware.exe with PID 2300
Why this is correct
Unusual name and no services; likely malware disguised.
- ✗
svchost.exe with PID 1780
Why it's wrong here
Legitimate service host for Schedule.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.