easyMultiple ChoiceObjective-mapped
CS0-003 Practice Question: An analyst needs to identify which process on a…
An analyst needs to identify which process on a Windows system is making outbound connections to the internet. Which tool should be used?
⚠ Common exam trap
CompTIA often tests the distinction between tools that show aggregate network usage (Task Manager) versus those that show per-connection process mapping (Resource Monitor), leading candidates to choose Task Manager because they associate it with network activity without realizing it lacks connection-level detail.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Resource Monitor
Resource Monitor (resmon.exe) provides a real-time view of network activity, including which processes are making outbound TCP and UDP connections, along with the remote addresses and ports. Unlike netstat, it directly associates network connections with specific process names and allows filtering by process, making it the most efficient tool for identifying the exact process responsible for outbound internet traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
netstat -an
Why it's wrong here
The `netstat -an` command displays all active TCP connections and listening ports numerically, showing local and foreign addresses along with their respective port numbers. However, this specific command switch combination does not include the Process ID (PID) or process name associated with each connection. Therefore, while it reveals network activity, it fails to directly link that activity to a specific process on the Windows system, making it inadequate for the analyst's goal of process identification.
- ✗
Task Manager
Why it's wrong here
Windows Task Manager provides a high-level overview of running processes, including basic network utilization metrics for each process under the "Performance" tab or "App history" for UWP apps. While it can indicate which processes are actively using the network, it does not offer granular details such as specific open connections, listening ports, or the remote addresses involved for each individual process. This lack of detailed connection mapping prevents an analyst from precisely identifying the network activity of a particular process.
- ✓
Resource Monitor
Why this is correct
Resource Monitor is a built-in Windows tool that provides detailed real-time information about hardware and software resource usage, including network activity. Under the "Network" tab, it clearly lists all processes with active network connections, displaying their associated Process IDs (PIDs), local and remote addresses, port numbers, and even latency. This comprehensive view allows an analyst to precisely identify which process is responsible for specific network communications, fulfilling the requirement to map network activity directly to a process.
- ✗
Performance Monitor
Why it's wrong here
Performance Monitor is primarily designed for collecting and viewing extensive performance data through counters, allowing for long-term trend analysis and system health monitoring. While it can track network interface statistics and even some per-process network I/O, it does not inherently provide a direct, real-time mapping of individual network connections to their originating processes. Its strength lies in aggregate performance metrics rather than granular process-to-connection identification, making it unsuitable for this specific task.
Visual reference
Go deeper
Related to this question
About these practice questions
This CS0-004 question is part of Courseiva's 236-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.