200-201 Host-Based Analysis — 25 Questions

Question 1

An analyst is investigating a Windows host suspected of malware persistence. Which registry key is commonly used by malware to run a program every time a user logs in, located under both HKLM and HKCU?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The Run and RunOnce keys under HKLM and HKCU are common persistence mechanisms. Malware often adds entries here to execute automatically at user logon.

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

Question 2

During an incident response on a Linux server, an analyst runs 'ps aux' and notices a process named 'cryptominer' with high CPU usage. The process PPID is 1. Which tool would best help the analyst examine the parent-child relationship and find how the process was started?

Accepted Answer

pstree. The pstree command shows the process hierarchy in a tree format, clearly displaying parent-child relationships. This helps trace how the malicious process was launched.

Answer

netstat

Answer

lsof

Answer

crontab -l

Question 3

A security analyst is analyzing a suspicious PE file. Using a hex editor, the analyst sees the MZ header (4D 5A). The file's entropy is calculated as 7.8. What does the high entropy most likely indicate?

Accepted Answer

The file is likely packed or obfuscated. High entropy (close to 8) suggests the file is packed or encrypted, as compressed or encrypted data has high randomness. This is often used by malware to evade signature detection.

Answer

The file is a legitimate signed binary

Answer

The file is corrupted

Answer

The file contains mostly plain text strings

Question 4

An analyst uses Volatility to analyze a memory dump from a compromised Windows machine. Which Volatility command would show the list of running processes along with their parent process IDs?

Accepted Answer

volatility -f mem.dmp pstree. The 'pstree' plugin in Volatility displays the process tree with parent-child relationships, helping identify suspicious process hierarchies.

Answer

volatility -f mem.dmp pslist

Answer

volatility -f mem.dmp malfind

Answer

volatility -f mem.dmp netscan

Question 5

A Linux administrator checks authentication logs to investigate a possible brute-force attack. Which log file typically contains records of successful and failed SSH login attempts?

Accepted Answer

/var/log/auth.log. On most Linux distributions, /var/log/auth.log (or /var/log/secure on Red Hat-based systems) records authentication events including SSH logins.

Answer

/var/log/kern.log

Answer

/var/log/messages

Answer

/var/log/syslog

Question 6

A Windows Event Log shows Event ID 4625 multiple times from the same source IP address. What type of activity does this indicate?

Accepted Answer

Failed logon attempts indicating a possible brute-force attack. Event ID 4625 indicates a failed logon attempt. Multiple failures from the same source suggest a brute-force attack.

Answer

Successful logon after multiple attempts

Answer

Credential validation by a domain controller

Answer

A user account was created

Question 7

During memory analysis with Volatility, the 'cmdline' plugin shows a process with no command-line arguments. Which plugin could help recover the original command line if it was truncated or hidden?

Accepted Answer

cmdscan. The 'cmdscan' plugin scans the memory for command-line history that might not be captured by cmdline. It can recover previously typed commands.

Answer

consoles

Answer

malfind

Answer

dlllist

Question 8

An analyst is examining a suspicious file that appears to be a PDF but when checking the magic bytes at offset 0, sees '50 4B 03 04'. What does this indicate?

Accepted Answer

The file is a ZIP archive. The magic bytes 50 4B 03 04 correspond to a ZIP archive (PK is the signature). This suggests the file is actually a ZIP file disguised with a PDF extension, possibly containing malicious content.

Answer

The file is a genuine PDF file

Answer

The file is a plain text file

Answer

The file is an executable

Question 9

An analyst uses 'sc query' on a Windows host and finds a service named 'WindowsUpdate' with a binary path pointing to 'C:\Users\Public\update.exe'. The service is running. Why is this suspicious?

Accepted Answer

The binary path is not in a system directory. Option D is correct because legitimate Windows services, especially those mimicking system components like Windows Update, should have their binary paths in protected system directories (e.g., C:\Windows\System32). A binary path pointing to C:\Users\Public\update.exe indicates the executable is in a user-writable location, which is a common technique used by malware to evade detection and maintain persistence. The 'sc query' command reveals the service configuration, and this abnormal path is a strong indicator of compromise.

Answer

The service is running

Answer

The service name is misspelled

Answer

The service displays 'WindowsUpdate'

Question 10

Which Windows artifact stores evidence of file execution, including the path and run count, and is located in C:\Windows\Prefetch?

Accepted Answer

Prefetch files. Prefetch files (*.pf) are created by Windows to speed up application loading. They contain metadata about executed programs, including execution count and last run time.

Answer

Windows Event Logs

Answer

Registry hives

Answer

Scheduled tasks

Question 11

A Linux host has an unusual cron job that runs a script from /tmp every minute. The analyst checks /etc/crontab and /var/spool/cron/ but finds nothing. Where else could the cron job be defined?

Accepted Answer

/etc/cron.d/. The cron job is defined in /etc/cron.d/ because this directory allows system administrators to drop individual cron configuration files that are parsed by the cron daemon. Unlike /etc/crontab and /var/spool/cron/ (which contain user-specific crontabs), /etc/cron.d/ is a standard location for package-maintained or custom cron jobs that run with system privileges. The fact that the analyst found nothing in the other two locations strongly suggests the job is defined in /etc/cron.d/.

Answer

/etc/cron.hourly/

Answer

/etc/cron.allow

Answer

~/.bashrc

Question 12

An analyst uses Volatility's 'netscan' on a memory dump and finds an established connection to an external IP on port 4444. Which type of activity is this commonly associated with?

Accepted Answer

Reverse shell or backdoor. Port 4444 is commonly used by Metasploit and other remote access tools for reverse shells. An established connection to an external IP on this port is indicative of a backdoor or command-and-control communication.

Answer

Email communication

Answer

DNS query

Answer

Normal web browsing

Question 13

An analyst is investigating a Windows host that likely has malware persistence via the registry. Which TWO registry hives are commonly used to store Run keys for user logon persistence? (Select 2)

Accepted Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. The Run keys under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run are standard locations where Windows executes programs automatically at user logon. Malware commonly writes entries to these keys to achieve persistence, making them critical for host-based analysis.

Answer

HKEY_CLASSES_ROOT\*\shell

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\AppInit_DLLs

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Question 14

A security analyst is analyzing a Linux system suspected of being used as a phishing server. Which THREE artifacts should the analyst examine to identify persistence mechanisms? (Select 3)

Accepted Answer

/etc/systemd/system/. Common Linux persistence mechanisms include cron jobs (crontab), systemd services, and startup scripts. Bash history may show commands but is not a persistence mechanism itself.

Answer

/var/log/auth.log

Answer

~/.bash_history

Question 15

A Windows Event Log analysis reveals Event ID 4720 and 4726 occurrences for the same account within a short time. Which TWO actions were performed? (Select 2)

Accepted Answer

User account was deleted. Event ID 4720 indicates account creation, and 4726 indicates account deletion. The rapid creation and deletion may indicate an attempt to avoid detection or create a temporary account.

Answer

User account was locked

Answer

Group policy was updated

Answer

User logged on successfully

Question 16

An analyst is investigating a Windows system for signs of malware persistence. Which registry key is commonly used by malware to run automatically at user logon?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a common persistence location for user-level autoruns.

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

Question 17

During incident response on a Linux server, an analyst runs 'ss -tlnp' and sees an SSH service listening on a non-standard high port. Which step should the analyst take next to investigate potential unauthorized access?

Accepted Answer

Examine /var/log/auth.log for successful logins.. Checking /var/log/auth.log for successful SSH logins on that port helps identify unauthorized connections.

Answer

Review the bash history of root user.

Answer

Check /etc/crontab for malicious scheduled tasks.

Answer

Run 'ps aux' to list all processes.

Question 18

An analyst is analyzing a suspicious executable file. Using the 'file' command, it returns 'data' instead of 'PE32 executable'. What is the most likely reason?

Accepted Answer

The file has been packed or encrypted to hide its true nature.. The 'data' result indicates the file's magic bytes do not match known executables, suggesting it might be packed or obfuscated.

Answer

The system is missing the file command database.

Answer

The file is a legitimate PE file with a different extension.

Answer

The file is actually a script written in Python.

Question 19

A forensic analyst uses Volatility on a memory dump and runs the 'malfind' plugin. The output shows a process with a VAD region that has PAGE_EXECUTE_READWRITE protection and contains the pattern 'MZ'. What does this indicate?

Accepted Answer

The process has been infected with code injection, likely a PE executable mapped in memory.. PAGE_EXECUTE_READWRITE protection combined with 'MZ' header suggests code injection, where a malicious executable has been written into the process memory.

Answer

The process is using a packed executable that was unpacked in memory.

Answer

The process has a heap spray attack, but not necessarily injected code.

Answer

The process is a legitimate browser with dynamic code.

Question 20

Which Windows Event ID is recorded when a user account is created, indicating potential unauthorized account creation?

Accepted Answer

4720. Event ID 4720 is logged when a user account is created in Active Directory or local SAM.

Answer

4726

Answer

4648

Answer

4624