SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A security analyst is examining a Windows workstation that has been exhibiting unusual outbound traffic to an IP address in a foreign country. The analyst runs `netstat -anob` and sees a process named `svchost.exe` listening on TCP port 4444 and maintaining an established connection to that foreign IP. The analyst knows that `svchost.exe` normally hosts legitimate Windows services. Which of the following is the MOST likely explanation for this finding?
⚠ Common exam trap
The trap here is assuming that any svchost.exe process is benign because it is a legitimate Windows process, when malware frequently masquerades as or injects into svchost.exe.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The `svchost.exe` process has been trojanized and is being used as a backdoor listener.
A legitimate svchost.exe process hosts Windows services and does not listen on arbitrary high ports or maintain external established connections. The presence of a listener on TCP 4444 with an active session to a foreign IP indicates a backdoor, often achieved by injecting malicious code into svchost.exe or replacing it. This behavior is a classic sign of a remote access trojan or command-and-control channel.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The `svchost.exe` process is hosting the Windows Time service and synchronizing with an external NTP server.
Why it's wrong here
The Windows Time service (W32Time) typically runs inside svchost.exe and communicates over UDP port 123. It does not create a listening TCP socket on port 4444 nor maintain a long-lived established TCP session to a foreign IP. The observed TCP listener and connection are inconsistent with NTP time synchronization, so this is not the likely cause.
- ✓
The `svchost.exe` process has been trojanized and is being used as a backdoor listener.
Why this is correct
Legitimate svchost.exe listens on local RPC ports but never on an arbitrary high port with an external established connection. Malware often injects into or replaces svchost.exe to blend in, creating a backdoor listener on a port like 4444. The established session to a foreign IP confirms command-and-control or remote access activity, making this the best explanation.
- ✗
A remote administration tool such as Remote Desktop is running on a non-standard port.
Why it's wrong here
Remote Desktop services run under svchost.exe but listen on TCP 3389 by default, and changing the port is uncommon in typical enterprise environments. A listening port of 4444 with an established foreign connection is far more consistent with a backdoor than with RDP, especially since RDP would normally show the TermService service and not an arbitrary high port.
- ✗
The workstation is participating in a legitimate peer-to-peer Windows Update delivery.
Why it's wrong here
Windows Update uses the Delivery Optimization service, typically running as svchost.exe, but it connects to Microsoft IP ranges over ports 80/443, not an arbitrary high port like 4444 with a persistent foreign connection. Peer-to-peer update traffic is also outbound-initiated and does not create a listening backdoor on the host, so this does not fit the observed behavior.
Visual reference
Go deeper
Related to this question
Learn chapter
ICS and SCADA Security Threats
Key term
TCP
TCP (Transmission Control Protocol) is a core internet protocol that ensures data is sent reliably and in order between devices over a network.
Key term
Trojan
A Trojan is a type of malware that disguises itself as a legitimate file or program to trick users into installing it, then performs harmful actions without the user's knowledge.
About these practice questions
One of 1,030 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.