200-201 Practice Test 16 — 15 Questions

Question 1

An analyst is examining a Linux system for persistence mechanisms. Which of the following files should be reviewed to detect cron-based persistence?

Accepted Answer

/var/spool/cron/crontabs. Cron jobs can be set in /etc/crontab, /etc/cron.d/, and user-specific crontabs in /var/spool/cron/. /var/spool/cron/crontabs contains per-user crontabs.

Answer

/var/log/auth.log

Answer

/etc/passwd

Answer

/home/user/.bash_history

Question 2

An analyst is investigating a Linux host and runs 'cat /proc/1234/cmdline'. What information does this provide?

Accepted Answer

The command line and arguments used to start the process. The /proc/[pid]/cmdline file contains the full command line used to start the process, including arguments. This helps verify if a process was launched with suspicious parameters.

Answer

The memory map of the process

Answer

The environment variables of the process

Answer

The current working directory of the process

Question 3

An analyst is investigating a Windows host for signs of malware persistence. Which registry key would the analyst check for programs that run automatically when any user logs in?

Accepted Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. The Run registry key under HKEY_LOCAL_MACHINE specifies programs that run for all users at logon, while HKEY_CURRENT_USER is per-user. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run is the most common location for malware persistence.

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

Answer

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services

Question 4

An organization wants to ensure that data sent over the internet cannot be read if intercepted. Which cryptographic method should be used?

Accepted Answer

Symmetric encryption with AES. Symmetric encryption, such as AES, provides confidentiality by encrypting data so that only those with the key can read it.

Answer

Digital signature using RSA

Answer

Hash-based message authentication code (HMAC)

Answer

Hashing with SHA-256

Question 5

An analyst is using Volatility to analyze a memory dump. Which TWO plugins are most effective for detecting code injection?

Accepted Answer

ldrmodules. malfind specifically detects injected code, and ldrmodules (or dlllist with ldrmodules) helps detect hidden/unlinked DLLs that may indicate injection. pslist shows processes, pstree shows tree, and netscan shows connections.

Answer

pslist

Answer

pstree

Answer

netscan

Question 6

An analyst examines a Windows endpoint and finds a suspicious executable in the Startup folder. Which registry key is commonly used for persistence via legitimate startup programs and is often abused by malware?

Accepted Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. The Run and RunOnce keys in both HKLM and HKCU cause programs to execute at user logon. They are commonly abused for persistence.

Answer

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\

Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

Question 7

An analyst is analyzing a suspicious PE file. The file's entropy is high (close to 8.0), and the section names appear random. What does this likely indicate?

Accepted Answer

The file is likely packed or encrypted.. High entropy suggests the file is packed or encrypted. Normal executables have lower entropy. Packed malware uses compression/encryption to obfuscate code.

Answer

The file is a script compiled to an executable.

Answer

The file is a legitimate Windows system file.

Answer

The file has been digitally signed.

Question 8

A Windows analyst uses Process Explorer to investigate parent-child relationships. Which TWO characteristics are commonly associated with malicious processes?

Accepted Answer

A process running from a user's Temp folder with a random name. Malware often spawns child processes from unusual parents (e.g., Microsoft Word spawning cmd.exe) and may have suspicious command-line arguments.

Answer

A parent process with a valid digital signature

Answer

A process with a long uptime and low CPU usage

Answer

A process chain where the parent is svchost.exe and child is explorer.exe

Question 9

MedSecure is a healthcare organization with a security policy that requires all security incidents to be handled following the NIST framework. A system administrator discovers that an unauthorized user has accessed a database containing patient records. The administrator immediately disconnects the server from the network. The security analyst is called to investigate. The analyst finds that the server was not part of the centralized logging system, and the only logs available are the database audit logs. The security policy mandates preservation of evidence and chain of custody. The analyst needs to collect the database audit logs. Which action should the analyst take to ensure proper evidence collection?

Accepted Answer

Make a bit-for-bit copy of the audit log files using a forensic tool, hash the original and copy, and document the process. Creating a bit-for-bit copy of the audit log files using a forensic tool, hashing both the original and copy, and documenting the process ensures data integrity and maintains chain of custody. This method preserves the original evidence and provides verifiable proof that the copy is identical. Option B (emailing CSV) compromises integrity and lacks chain of custody. Option C (full disk image) is excessive for collecting only log files and may introduce unnecessary complexity. Option D (copy to USB) does not use forensic tools or proper documentation, failing to preserve integrity.

Answer

Export the logs to a CSV file and email them to the security team

Answer

Use a write-blocker to create a forensic image of the entire hard drive

Answer

Copy the audit logs to a USB drive and store it in a locked drawer

Question 10

During memory analysis using Volatility, an analyst wants to identify processes that may be hiding. Which TWO plugins are most useful for detecting hidden or injected code? (Choose two.)

Accepted Answer

malfind. psxview compares process listings from different sources to find discrepancies, while malfind detects injected code. pslist lists normally, and cmdline shows command lines.

Answer

pslist

Answer

dlllist

Answer

cmdline

Question 11

An analyst is analyzing a Linux system that may have been compromised. Which THREE artifacts would provide evidence of attacker activity? (Choose three.)

Accepted Answer

/var/spool/cron/crontabs/. Bash history contains commands executed by users, auth.log records login attempts, and cron jobs can be used for persistence. /etc/passwd shows user accounts but not activity.

Answer

/proc/cpuinfo

Answer

/etc/passwd

Question 12

An analyst is reviewing Windows Event Logs and sees multiple Event ID 4625 entries from a single IP address. What does this indicate?

Accepted Answer

A brute-force password guessing attack.. Event ID 4625 is a failed logon attempt. Multiple failures from the same IP suggest a brute-force attack.

Answer

A user account was locked out.

Answer

A service account password expired.

Answer

Successful remote logins from that IP.

Question 13

Which Windows Event ID corresponds to a successful user logon?

Accepted Answer

4624. Event ID 4624 is logged when a user successfully logs on to a system.

Answer

4648

Answer

4776

Answer

4625

Question 14

During a host-based analysis of a Windows system, an analyst finds that the Windows Event ID 4688 (process creation) logs show a child process spawning from a legitimate application, but the parent process path is empty. What does this likely indicate?

Accepted Answer

The process was spawned via a WMI call without a parent path. When a process is spawned via Windows Management Instrumentation (WMI), the parent process path is often empty in Event ID 4688 logs because WMI creates the child process in a way that does not preserve the standard parent-child relationship. This occurs because WMI uses the `Win32_Process.Create` method, which runs under the WMI provider host process (WmiPrvSE.exe) but does not populate the parent process path field in the security log. The empty parent path is a strong indicator of WMI-based process creation, which is commonly used for lateral movement or persistence by attackers.

Answer

The parent process was terminated immediately after spawning

Answer

The event log is corrupted

Answer

The process is a kernel thread

Question 15

An analyst discovers an unknown process on a Windows host that has no parent process (PPID 0). What does this likely indicate?

Accepted Answer

The process is likely hidden or injected by malware.. A process with PPID 0 is unusual and may indicate a rootkit or direct kernel manipulation. Normal processes have a parent, except for the System Idle Process (PID 0).

Answer

The process is a child of the System Idle Process.

Answer

The process is a user-initiated task running normally.

Answer

The process is a legitimate system process started at boot.