CompTIA Exam PT0-002 Topic 1 Question 54 Discussion

Actual exam question for CompTIA's PT0-002 exam

Question #: 54
Topic #: 1

After successfully compromising a remote host, a security consultant notices an endpoint protection software is running on the host. Which of the following commands would be

best for the consultant to use to terminate the protection software and its child processes?

Ataskkill /PID <PID> /T /F

Btaskkill /PID <PID> /IM /F

Ctaskkill /PID <PID> /S /U

Dtaskkill /PID <PID> /F /P

Show Suggested Answer

Suggested Answer: A

The taskkill command is used in Windows to terminate tasks by process ID (PID) or image name (IM). The correct command to terminate a specified process and any child processes which were started by it uses the /T flag, and the /F flag is used to force terminate the process. Therefore, taskkill /PID <PID> /T /F is the correct syntax to terminate the endpoint protection software and its child processes.

The other options listed are either incorrect syntax or do not accomplish the task of terminating the child processes:

* /IM specifies the image name but is not necessary when using /PID.

* /S specifies the remote system to connect to and /U specifies the user context under which the command should execute, neither of which are relevant to terminating processes.

* There is no /P flag in the taskkill command.

by Nichelle at Apr 24, 2024, 02:31 PM

Limited Time Offer

25%

I think the best command to use would be A) taskkill /PID /T /F.

upvoted 0 times

...