200-201 Host-Based Analysis Practice Test 10 — 15 Questions

Question 1

A threat hunter is examining a Linux web server that is suspected of being compromised. The hunter wants to identify suspicious processes that may be communicating with external command-and-control infrastructure and to understand what files those processes have open. Which TWO artifacts or commands should the hunter use to accomplish these goals? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run 'ss -tunap' to enumerate listening and established sockets with their owning processes. Mapping C2 traffic and open files on Linux requires live process-to-socket visibility. The ss command with -tunap enumerates sockets together with owning processes, exposing established outbound connections. The /proc filesystem complements this by exposing per-process socket inodes and open file descriptors, letting the hunter pivot from a suspicious PID to the exact files and connections it holds. Together they reveal both the communication channel and the process context.

Answer

Review /var/log/secure for failed authentication attempts

Answer

Parse the wtmp and btmp binary logs with the 'last' command

Answer

Examine /etc/crontab for scheduled jobs

Question 2

A security analyst is reviewing a Windows workstation that is suspected of being infected with malware that establishes persistence. The analyst wants to check a location that is commonly used by malware to automatically start when a user logs on. Which of the following should the analyst examine?

Accepted Answer

The Startup folder for the current user. The Startup folder is a well-known user-level persistence location. Any program or shortcut placed there will execute automatically when the user logs on. Malware frequently uses this folder because it requires no administrative privileges and is easy to implement. Analysts should check both the per-user Startup folder and the all-users Startup folder for suspicious entries.

Answer

The Recycle Bin

Answer

The Prefetch folder

Answer

The Windows Defender quarantine folder

Question 3

An analyst is reviewing a Linux host that is suspected of being compromised. The analyst runs 'ls -l /proc/1234/exe' and sees that the symbolic link points to '/tmp/.hidden/backdoor'. The process with PID 1234 is owned by root and was started from an unknown parent process. Which of the following best describes what the analyst has discovered?

Accepted Answer

The process is a malicious binary running from a non-standard location, indicating a potential compromise.. The /proc/PID/exe symbolic link reveals the actual executable file backing a running process. A root-owned process executing from a hidden directory under /tmp is a classic sign of malware or an attacker's backdoor, as legitimate system processes rarely reside there. This discovery warrants immediate further investigation, such as examining the binary and its network connections.

Answer

The process is a kernel thread that has been incorrectly linked to a user-space file.

Answer

The process is a legitimate system daemon that has been relocated to /tmp for performance reasons.

Answer

The process is a containerized application that uses /tmp as its working directory.

Question 4

A security analyst is examining a Windows 10 endpoint suspected of compromise. The analyst runs `wmic process get name,processid,executablepath,parentprocessid` and observes a process named `lsass.exe` with PID 1234 and executable path `C:\Windows\Temp\lsass.exe`. The legitimate lsass.exe should reside in `C:\Windows\System32`. Which of the following is the MOST likely explanation?

Accepted Answer

A malware sample is masquerading as lsass.exe to evade detection by name-based monitoring.. Legitimate Windows system processes run from specific system directories, such as System32. When a process named lsass.exe is found in a non-standard location like C:\Windows\Temp, it is almost certainly malware attempting to hide by using a trusted process name. The analyst should treat this as a compromise, isolate the host, and perform further forensics including file hash analysis and persistence checks.

Answer

The output is a false positive because wmic sometimes reports incorrect executable paths for system processes.

Answer

The system is experiencing a file system corruption that moved lsass.exe to a temporary folder.

Answer

The process is a legitimate instance of lsass.exe that was moved by a Windows Update.

Question 5

An analyst is investigating a Windows 10 workstation suspected of being compromised. The analyst runs `wmic process get name,processid,parentprocessid,commandline` and observes a process named `powershell.exe` with the command line `powershell -nop -w hidden -enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAA...`. What does the `-enc` parameter indicate about how the command was executed?

Accepted Answer

The command was Base64-encoded to obfuscate its contents.. The `-enc` parameter in PowerShell stands for `-EncodedCommand`, which accepts a Base64-encoded string representing the actual command. Attackers use it to obfuscate malicious scripts and bypass simple command-line logging. An analyst should decode the Base64 string to reveal the true intent, such as downloading a payload or establishing persistence.

Answer

The command was encrypted with AES and requires a key to decrypt.

Answer

The command was signed with a digital certificate to appear legitimate.

Answer

The command was compressed using gzip to reduce its size.

Question 6

A security analyst suspects that a Windows workstation was compromised by malware that schedules a recurring task to maintain persistence. The analyst opens Task Scheduler and sees dozens of scheduled tasks. Which built-in command-line utility should the analyst use to export a detailed list of all scheduled tasks, including the actions they perform, so the list can be reviewed offline?

Accepted Answer

schtasks /query /fo LIST /v. Scheduled tasks are a common persistence mechanism because they can launch a payload on a schedule or at logon. The schtasks utility is the native command-line interface to the Task Scheduler service, and the /query /fo LIST /v combination produces a verbose, exportable inventory of every task, including its action and trigger. That output can be reviewed offline to identify the malicious recurring task.

Answer

tasklist /v /fo csv

Answer

wmic startup list full

Answer

sc query type= service state= all

Question 7

A security analyst is reviewing Windows Event Logs to determine if a user account was recently created on a compromised host. Which Windows Event ID should the analyst look for in the Security log to identify user account creation events?

Accepted Answer

Event ID 4720. Windows Security Event ID 4720 is specifically logged when a user account is created. It contains fields such as TargetUserName (the new account) and SubjectUserName (the account that created it). This event is critical for detecting unauthorized account creation, which attackers often use for persistence. Other event IDs like 4624 (logon) or 4625 (failed logon) do not indicate account creation.

Answer

Event ID 4672

Answer

Event ID 4624

Answer

Event ID 4625

Question 8

A security analyst is examining a Linux web server that is suspected of being compromised. The analyst runs `ps aux` and notices a process named `apache2` running as the user `www-data`, but its parent process ID (PPID) is 1 (init/systemd). Normally, `apache2` is started by a master process. What is the most likely explanation for this anomaly?

Accepted Answer

The `apache2` process was re-parented to init after its original parent terminated.. On Linux, when a parent process dies, its children are re-parented to PID 1 (init/systemd). An `apache2` worker with PPID 1 indicates its original parent (the Apache master) is no longer running, which is unusual and may indicate tampering or a crash. This warrants further investigation into process lineage and system logs.

Answer

The `apache2` process is a kernel thread masquerading as a user process.

Answer

The `apache2` process was started by systemd as a direct child of PID 1.

Answer

The `apache2` process was started by a cron job.

Question 9

An analyst is reviewing logs on a Windows 10 host that is suspected of being compromised. The analyst runs 'wevtutil qe Security /q:"*[System[(EventID=4688)]]" /f:text' and sees that a process named 'powershell.exe' was launched by 'winword.exe' with the command line 'powershell -nop -w hidden -enc SQBFAFgA...'. Which type of malicious activity does this most likely indicate?

Accepted Answer

A macro-based document exploit spawning an encoded PowerShell payload. The parent-child relationship between winword.exe and powershell.exe with encoded, hidden arguments is a well-known indicator of a malicious macro exploit. Attackers often use Office documents to launch PowerShell stagers that download or execute further payloads. This pattern is commonly seen in phishing campaigns and is a key detection point for endpoint security tools.

Answer

A user manually running a PowerShell script for administrative purposes

Answer

A legitimate Office add-in that uses PowerShell for automation

Answer

A scheduled task created by Windows Update to install patches

Question 10

A junior analyst is triaging a Windows workstation that users report is running slowly. The analyst suspects a malicious process is persisting by masquerading as a legitimate Windows service. Which built-in Windows tool should the analyst use to view services, their binary paths, and their current state without installing additional software?

Accepted Answer

The Services console (services.msc). The Services console (services.msc) is the native Windows management interface that enumerates all installed services and exposes each one's display name, status, start type, and the path to its executable. By reviewing those paths, the analyst can identify a service whose binary resides in an unexpected location, which is a common masquerading persistence method, without deploying any additional tooling.

Answer

Performance Monitor (perfmon.msc)

Answer

Task Manager's Processes tab

Answer

Event Viewer's Application log

Question 11

During a host investigation on a Windows 10 endpoint, an analyst wants to review the history of commands typed into PowerShell consoles by interactive users. Which artifact should the analyst examine?

Accepted Answer

The PowerShell console host history file at %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt. Interactive PowerShell commands are captured by the PSReadLine module, which appends each entered line to ConsoleHost_history.txt in the user's AppData roaming profile. This file survives reboots and gives investigators a chronological list of commands typed at the console, including download cradle strings and lateral-movement commands, without requiring transcription or module logging to have been enabled beforehand.

Answer

The Windows Prefetch directory, examining POWERSHELL.EXE-*.pf

Answer

The Application event log filtered for PowerShell source events

Answer

The Windows Security event log filtered for Event ID 4688

Question 12

A security analyst is investigating a Linux host for signs of compromise. The analyst runs `ps aux` and notices a process named `kworker` with a high CPU usage. The analyst suspects this may be a masquerading malware process. Which TWO commands should the analyst use to verify whether this process is legitimate or malicious? (Choose two.)

Accepted Answer

`ls -l /proc//exe` to check the executable path. Legitimate kernel worker threads (kworker) have no user-space executable and an empty cmdline. Checking /proc//exe reveals if the process points to a real binary, and /proc//cmdline shows the command line. If either indicates a user-space path or non-empty arguments, the process is likely masquerading. These two checks together provide strong evidence.

Answer

`df -h` to check disk usage

Answer

`netstat -tulpn` to list all listening ports

Answer

`top -c` to view the process list with command lines

Question 13

A security analyst is examining a Windows 10 host and suspects that an attacker has established persistence using a scheduled task. The analyst runs 'schtasks /query /fo LIST /v' and observes a task named 'WindowsUpdateCheck' with the action 'C:\Users\Public\update.exe' and a trigger set to run every 5 minutes. Which of the following best describes the attacker's technique?

Accepted Answer

The attacker is using a scheduled task to maintain persistence and execute a malicious binary at regular intervals.. Scheduled tasks are frequently abused by attackers to establish persistence. The task name 'WindowsUpdateCheck' is designed to look benign, but the executable path in C:\Users\Public and the 5-minute interval are suspicious. Attackers use such tasks to ensure their malware runs regularly, even after reboots. Analysts should investigate the binary and the task's origin.

Answer

The attacker is using a WMI event subscription to maintain persistence and execute a malicious binary at regular intervals.

Answer

The attacker is using a registry Run key to maintain persistence and execute a malicious binary at regular intervals.

Answer

The attacker is using a service to maintain persistence and execute a malicious binary at regular intervals.

Question 14

An analyst is investigating a Linux server and suspects that an attacker has established persistence by modifying system startup scripts. The analyst runs 'ls -la /etc/rc.local' and finds it has been modified recently. Which TWO additional artifacts should the analyst examine to identify other potential persistence mechanisms? (Choose two.)

Accepted Answer

/etc/cron.d/. Attackers on Linux often use systemd service files and cron jobs for persistence because they are executed automatically and can blend in with legitimate system tasks. The /etc/systemd/system/ directory contains custom service units, and /etc/cron.d/ holds cron definitions. Both are critical to examine when hunting for persistence, as they allow code execution without user interaction.

Answer

/etc/passwd

Answer

/var/log/auth.log

Answer

/etc/hosts

Question 15

A CyberOps analyst is examining a Windows workstation and finds that a scheduled task named 'MicrosoftEdgeUpdateTask' exists in Task Scheduler, but the Task Scheduler GUI shows it as disabled. The analyst suspects it was created by malware to masquerade as a legitimate updater. Which artifact should the analyst check to determine the exact executable path and arguments the task would run if it were enabled?

Accepted Answer

The XML definition of the task, stored under C:\Windows\System32\Tasks and readable with schtasks /query /xml.. The authoritative source for what a scheduled task executes is its XML definition, which lists the action's executable, arguments, and working directory. Reading it directly with schtasks /query /xml bypasses the GUI's disabled display and reveals the true payload. Event logs and file system journals provide timing and creation context but not the task's action content, so they cannot answer what the task would run.

Answer

The prefetch file for schtasks.exe located in C:\Windows\Prefetch.

Answer

The Task Scheduler operational event log (Microsoft-Windows-TaskScheduler/Operational) filtered for Event ID 106.

Answer

The file system journal for the C: volume, queried with fsutil usn readjournal, filtered to the Tasks directory.