200-201 Practice Test 21 — 15 Questions

Question 1

An analyst is analyzing a suspicious executable file. Using the 'file' command, it returns 'data' instead of 'PE32 executable'. What is the most likely reason?

Accepted Answer

The file has been packed or encrypted to hide its true nature.. The 'data' result indicates the file's magic bytes do not match known executables, suggesting it might be packed or obfuscated.

Answer

The system is missing the file command database.

Answer

The file is a legitimate PE file with a different extension.

Answer

The file is actually a script written in Python.

Question 2

An analyst notices a Zeek (Bro) connection log showing a single HTTP request from internal IP 192.168.1.10 to external IP 203.0.113.5 with a URI of '/files/secret.docx' and a response code of 200. The file size is unusually large (50 MB). What should the analyst suspect?

Accepted Answer

Data exfiltration. A large file download over HTTP from an internal host to an external IP, especially with a filename like 'secret.docx', suggests data exfiltration. The single request and response code 200 indicate successful transfer.

Answer

Phishing attempt

Answer

Malware download

Answer

Normal business activity

Question 3

During an incident response, a Linux system shows unusual outbound network connections from a process named 'httpd'. The analyst uses 'ss -tlnp' to examine listening sockets. Which column would most likely indicate if the process is malicious?

Accepted Answer

Process. The 'Process' column in 'ss -tlnp' shows the PID and process name. If the process name is misrepresented or the PID does not match a legitimate httpd, it indicates malicious activity.

Answer

Local Address:Port

Answer

State

Answer

Peer Address:Port

Question 4

An analyst is examining a PE file and notices that the 'TimeDateStamp' in the optional header is 0x00000000. What does this suggest?

Accepted Answer

The timestamp has been deliberately erased or not set, possibly to avoid forensic analysis.. A timestamp of zero often indicates the linker did not set it, which is common for malware or files compiled with certain tools that omit the timestamp.

Answer

The file is digitally signed.

Answer

The file was compiled on January 1, 1970 (Unix epoch).

Answer

The file is a DLL rather than an executable.

Question 5

An analyst uses Volatility to analyze a memory dump from a compromised Windows machine. Which Volatility command would show the list of running processes along with their parent process IDs?

Accepted Answer

volatility -f mem.dmp pstree. The 'pstree' plugin in Volatility displays the process tree with parent-child relationships, helping identify suspicious process hierarchies.

Answer

volatility -f mem.dmp pslist

Answer

volatility -f mem.dmp malfind

Answer

volatility -f mem.dmp netscan

Question 6

A Windows event log review shows Event ID 4625 multiple times from a single source IP. What does this event indicate, and which log contains it?

Accepted Answer

Failed logon; Security log. Event ID 4625 is a failed logon attempt, recorded in the Security log.

Answer

Successful logon; System log

Answer

Service start; System log

Answer

Account creation; Application log

Question 7

A Windows Event Log shows Event ID 4625 multiple times from the same source IP address. What type of activity does this indicate?

Accepted Answer

Failed logon attempts indicating a possible brute-force attack. Event ID 4625 indicates a failed logon attempt. Multiple failures from the same source suggest a brute-force attack.

Answer

Successful logon after multiple attempts

Answer

Credential validation by a domain controller

Answer

A user account was created

Question 8

A Linux analyst notices a process named '[kworker/1:1+events]' in the process list with high CPU usage. Which further analysis step would help determine if this is a legitimate kernel worker or a rootkit hiding as one?

Accepted Answer

Check /proc/[pid]/cmdline; if empty, it is likely a kernel thread, otherwise it is a user-space process masquerading.. Checking /proc/[pid]/cmdline for the process ID can reveal if it has a command line; legitimate kernel threads have empty cmdline, while user-space processes do not.

Answer

Run 'ls -la /proc/[pid]/exe' to see the symbolic link target.

Answer

Examine /var/log/syslog for kernel messages.

Answer

Use 'strace' to trace system calls of the process.

Question 9

An analyst uses Volatility's 'netscan' on a memory dump and finds an established connection to an external IP on port 4444. Which type of activity is this commonly associated with?

Accepted Answer

Reverse shell or backdoor. Port 4444 is commonly used by Metasploit and other remote access tools for reverse shells. An established connection to an external IP on this port is indicative of a backdoor or command-and-control communication.

Answer

Email communication

Answer

DNS query

Answer

Normal web browsing

Question 10

An analyst discovers that a Windows system executes a payload each time a user logs in, even before the desktop appears. Which registry key is most likely used for such persistence, and why would it be harder to detect than typical Run keys?

Accepted Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs. AppInit_DLLs loads DLLs into every process that loads user32.dll, making it a stealthy persistence mechanism.

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Question 11

An analyst examining a Linux server notices an unusual cron job in /etc/crontab that runs a script every 5 minutes. Which of the following describes the best approach to determine if this cron job is malicious?

Accepted Answer

Check the script's content, owner, and compare its hash with known threats.. Inspecting the script content and correlating with known persistence techniques helps assess maliciousness.

Answer

Ignore it because cron jobs are always legitimate.

Answer

Delete the cron job immediately to stop potential malicious activity.

Answer

Run the script in a sandbox to see what it does.

Question 12

During a Linux forensic investigation, an analyst finds a suspicious process. The analyst wants to check for persistence mechanisms. Which THREE Linux artifacts should be examined?

Accepted Answer

/etc/crontab and /var/spool/cron/. Cron jobs, systemd services, and bash history are common artifacts for persistence. Cron and systemd can schedule execution, bash history may show past commands.

Answer

/var/log/auth.log

Answer

/proc/net/tcp

Question 13

An analyst is reviewing Windows Event Logs and sees Event ID 4625. What does this event indicate?

Accepted Answer

An account logon failed. Event ID 4625 in the Security log indicates a failed logon attempt. This is often used to detect brute-force attacks or unauthorized access attempts.

Answer

Credential validation was attempted

Answer

An account was created

Answer

An account was successfully logged on

Question 14

An analyst is investigating a Windows system where a suspicious executable is running. Using Process Explorer, the analyst observes that the process 'svchost.exe' has a parent process of 'cmd.exe'. What is the significance of this parent-child relationship?

Accepted Answer

It indicates that svchost.exe is likely malicious, as it should be spawned by services.exe. Legitimate svchost.exe processes are spawned by services.exe, not cmd.exe. A parent of cmd.exe indicates that svchost.exe was launched manually, which is abnormal and suggests malicious activity.

Answer

It shows that svchost.exe is a critical system process and is safe

Answer

It suggests that svchost.exe is a child of explorer.exe, which is normal

Answer

It is normal behavior; svchost.exe often has cmd.exe as parent

Question 15

An analyst is investigating a Windows host for malware persistence. Which TWO registry locations are commonly abused for persistence by modifying the 'Run' key? (Select TWO)

Accepted Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\Run. Both HKLM and HKCU Run keys are commonly used for persistence.

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

Answer

HKLM\System\CurrentControlSet\Services

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders