200-201 Host-Based Analysis — 10 Questions

Question 1

An analyst is investigating a Windows host suspected of malware persistence. Which registry key is commonly used by malware to run a program every time a user logs in, located under both HKLM and HKCU?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The Run and RunOnce keys under HKLM and HKCU are common persistence mechanisms. Malware often adds entries here to execute automatically at user logon.

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

Question 2

During an incident response on a Linux server, an analyst runs 'ps aux' and notices a process named 'cryptominer' with high CPU usage. The process PPID is 1. Which tool would best help the analyst examine the parent-child relationship and find how the process was started?

Accepted Answer

pstree. The pstree command shows the process hierarchy in a tree format, clearly displaying parent-child relationships. This helps trace how the malicious process was launched.

Answer

netstat

Answer

lsof

Answer

crontab -l

Question 3

A security analyst is analyzing a suspicious PE file. Using a hex editor, the analyst sees the MZ header (4D 5A). The file's entropy is calculated as 7.8. What does the high entropy most likely indicate?

Accepted Answer

The file is likely packed or obfuscated. High entropy (close to 8) suggests the file is packed or encrypted, as compressed or encrypted data has high randomness. This is often used by malware to evade signature detection.

Answer

The file is a legitimate signed binary

Answer

The file is corrupted

Answer

The file contains mostly plain text strings

Question 4

An analyst uses Volatility to analyze a memory dump from a compromised Windows machine. Which Volatility command would show the list of running processes along with their parent process IDs?

Accepted Answer

volatility -f mem.dmp pstree. The 'pstree' plugin in Volatility displays the process tree with parent-child relationships, helping identify suspicious process hierarchies.

Answer

volatility -f mem.dmp pslist

Answer

volatility -f mem.dmp malfind

Answer

volatility -f mem.dmp netscan

Question 5

A Linux administrator checks authentication logs to investigate a possible brute-force attack. Which log file typically contains records of successful and failed SSH login attempts?

Accepted Answer

/var/log/auth.log. On most Linux distributions, /var/log/auth.log (or /var/log/secure on Red Hat-based systems) records authentication events including SSH logins.

Answer

/var/log/kern.log

Answer

/var/log/messages

Answer

/var/log/syslog

Question 6

A Windows Event Log shows Event ID 4625 multiple times from the same source IP address. What type of activity does this indicate?

Accepted Answer

Failed logon attempts indicating a possible brute-force attack. Event ID 4625 indicates a failed logon attempt. Multiple failures from the same source suggest a brute-force attack.

Answer

Successful logon after multiple attempts

Answer

Credential validation by a domain controller

Answer

A user account was created

Question 7

During memory analysis with Volatility, the 'cmdline' plugin shows a process with no command-line arguments. Which plugin could help recover the original command line if it was truncated or hidden?

Accepted Answer

cmdscan. The 'cmdscan' plugin scans the memory for command-line history that might not be captured by cmdline. It can recover previously typed commands.

Answer

consoles

Answer

malfind

Answer

dlllist

Question 8

An analyst is examining a suspicious file that appears to be a PDF but when checking the magic bytes at offset 0, sees '50 4B 03 04'. What does this indicate?

Accepted Answer

The file is a ZIP archive. The magic bytes 50 4B 03 04 correspond to a ZIP archive (PK is the signature). This suggests the file is actually a ZIP file disguised with a PDF extension, possibly containing malicious content.

Answer

The file is a genuine PDF file

Answer

The file is a plain text file

Answer

The file is an executable

Question 9

An analyst uses 'sc query' on a Windows host and finds a service named 'WindowsUpdate' with a binary path pointing to 'C:\Users\Public\update.exe'. The service is running. Why is this suspicious?

Accepted Answer

The binary path is not in a system directory. Legitimate Windows services, especially those mimicking system components like Windows Update, should have their binary paths in protected system directories (e.g., C:\Windows\System32). A binary path pointing to C:\Users\Public\update.exe indicates the executable is in a user-writable location, which is a common technique used by malware to evade detection and maintain persistence. The 'sc query' command reveals the service configuration, and this abnormal path is a strong indicator of compromise.

Answer

The service is running

Answer

The service name is misspelled

Answer

The service displays 'WindowsUpdate'

Question 10

Which Windows artifact stores evidence of file execution, including the path and run count, and is located in C:\Windows\Prefetch?

Accepted Answer

Prefetch files. Prefetch files (*.pf) are created by Windows to speed up application loading. They contain metadata about executed programs, including execution count and last run time.

Answer

Windows Event Logs

Answer

Registry hives

Answer

Scheduled tasks