easyMultiple ChoiceObjective-mapped

200-201 Practice Question: Refer to the exhibit

Exhibit

Refer to the exhibit.

tasklist /svc /fi "PID eq 1234"
Image Name                     PID Services
========================= ======== ============================================
svchost.exe                   1234 CryptSvc, Dnscache, LanmanWorkstation, W32Time

Refer to the exhibit. An analyst runs the command 'tasklist /svc /fi "PID eq 1234"' on a Windows host and receives the output shown. Which conclusion can the analyst draw from this output?

⚠ Common exam trap

Cisco often tests the misconception that any svchost.exe process is suspicious or malware, but the key is to recognize that legitimate svchost.exe instances host specific Windows services and are identified by their associated service names and standard system paths.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The process is a legitimate Windows service host

The 'tasklist /svc /fi "PID eq 1234"' command filters for a specific PID and displays the associated services. The output shows 'svchost.exe' with the service 'DcomLaunch', which is a core Windows component responsible for launching COM and DCOM services. This confirms the process is a legitimate Windows service host, not a third-party application or malware.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The process is a third-party application
Why it's wrong here
The services listed (CryptSvc, Dnscache, etc.) are Windows system services, not third-party.
✗
The process is using excessive CPU resources
Why it's wrong here
The output does not include CPU usage information.
✓
The process is a legitimate Windows service host
Why this is correct
svchost.exe is a legitimate Windows process that hosts multiple system services.
✗
The process is likely malware masquerading as svchost.exe
Why it's wrong here
While svchost.exe can be mimicked, the listed services are standard Windows services, so there is no indication of masquerading.

Go deeper

200-201 Practice Question: Refer to the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question