Examkin

Question

Difficulty: MediumMicrosoft Command-Line Tools

A system administrator is investigating a malfunctioning background application on a Windows workstation that is consuming excessive CPU resources and maintaining unauthorized network connections. Arrange the command-line actions in the correct sequential order to identify, inspect, terminate, and verify the removal of the problematic process.

  1. 1Run `tasklist` to locate the application and identify its Process ID (PID).
  2. 2Run `netstat -ano` to map active network connections and listening ports directly to the identified PID.
  3. 3Run `taskkill /pid <PID> /t /f` to forcefully terminate the process along with any child processes it spawned.
  4. 4Run `tasklist /fi "IMAGENAME eq executable.exe"` to verify that no instances of the process remain active in memory.

Answer

The correct order of operations is: 1) Run `tasklist` to obtain the PID, 2) Run `netstat -ano` to inspect network sockets for that PID, 3) Run `taskkill /pid <PID> /t /f` to forcefully stop the process tree, and 4) Run `tasklist /fi "IMAGENAME eq executable.exe"` to verify complete termination.
The correct troubleshooting sequence begins with process identification via `tasklist`, followed by network socket inspection using `netstat -ano` to confirm connection ownership, forceful process tree termination via `taskkill /pid <PID> /t /f`, and concluding with filter verification via `tasklist /fi`.

Step-by-Step Solution

1
Identify the Process ID (PID) using `tasklist`
Obtain the specific numeric PID associated with the target application.
Process management utilities like netstat and taskkill require the target PID for detailed socket mapping and targeted termination.
2
Correlate network activity using `netstat -ano`
Confirm active network socket connections owned by the target PID.
The `-o` switch displays the owning PID for each active socket, enabling verification of the process's network activity.
3
Forcefully terminate the process tree using `taskkill /pid <PID> /t /f`
The target process and all child processes spawned by it are stopped immediately.
The `/f` switch forces termination of non-responsive applications, while `/t` ensures child processes in the process tree are also halted.
4
Verify process termination using `tasklist /fi "IMAGENAME eq executable.exe"`
Confirm that zero running instances match the target executable image name.
Post-remediation filter verification ensures that no remaining instances or child processes are running in system memory.

Key Concept

Windows Command-Line Process Management and Network Diagnostic Sequence
Rate this question

Topics

Microsoft Command-Line Tools

More questions from this topic