200-201 Host-Based Analysis Practice Test 11 — 15 Questions

Question 1

A security analyst is examining a Linux system for signs of a compromised user account. The analyst runs `grep ':0:0:' /etc/passwd` and finds an entry for user `backup` with UID 0. The legitimate backup user should have a UID of 1001. Which of the following is the MOST likely explanation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An attacker modified /etc/passwd to give the backup user root privileges for persistence or privilege escalation.. In /etc/passwd, the third field is the UID. UID 0 is reserved for the root account. If a non-root user like backup has UID 0, it means that account has root privileges. This is a common attacker technique to maintain access: they either modify an existing account or create a new one with UID 0. The analyst should investigate the file's modification time, check for other anomalies, and review authentication logs for the backup user.

Answer

The output is a false positive because `grep ':0:0:'` also matches group ID 0, not just UID.

Answer

The backup user was accidentally assigned UID 0 during system installation.

Answer

The backup user is a system account that is supposed to have UID 0 for performing backup operations.

Question 2

A security analyst is examining a Linux system for signs of a compromised user account. The analyst runs `grep ':0:0:' /etc/passwd` and finds an entry for user `backup` with UID 0. The legitimate backup user should have a UID of 1001. Which of the following is the MOST likely explanation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The module's reference count is artificially incremented to prevent removal.. Rootkits frequently manipulate kernel structures to prevent their removal. By incrementing the module's reference count or hooking the `delete_module` system call, they make `rmmod` fail with 'in use'. This ensures the rootkit remains loaded. Analysts should use memory forensics or reboot to a trusted environment to remove such modules.

Answer

The module was loaded with `modprobe` and requires `modprobe -r` to remove.

Answer

The module is compiled into the kernel and cannot be removed.

Answer

The module is currently being used by a legitimate process such as `systemd`.

Question 3

A security analyst is examining a Windows 10 host that is suspected of being compromised. The analyst runs `wmic process get name,processid,executablepath,commandline` and notices a process named `svchost.exe` with an executable path of `C:\Users\Public\svchost.exe`. Which conclusion is most accurate?

Accepted Answer

The process is likely malware masquerading as svchost.exe.. Legitimate svchost.exe always runs from %SystemRoot%\System32\svchost.exe. An instance with an executable path in C:\Users\Public is almost certainly malware masquerading as a system process. Attackers use this technique to blend in with normal system activity. Analysts should verify the digital signature, parent process, and loaded modules to confirm maliciousness.

Answer

The process is a legitimate svchost.exe because the name matches the system process.

Answer

The process is a legitimate svchost.exe running from a non-standard location due to a Windows update.

Answer

The process is likely a legitimate svchost.exe that was copied to the Public folder by a user.

Question 4

A security analyst is triaging a Windows server that may have been compromised. The analyst needs to identify which network connections are currently established by processes on the host and which executable is responsible for each connection. Which two native tools provide this information? (Choose two.)

Accepted Answer

Get-NetTCPConnection -State Established. Mapping active connections to the processes that own them requires tools that expose both socket state and the owning PID. netstat with the -a, -n, and -o switches reports all connections numerically with the PID, while the Get-NetTCPConnection cmdlet returns objects whose OwningProcess property carries the same identifier. Either output can then be joined with a process listing to name the responsible executable.

Answer

ipconfig /all

Answer

arp -a

Answer

route print

Question 5

A security analyst is examining a Windows 10 endpoint that is suspected of being infected with malware. The analyst runs 'Get-WinEvent -LogName Security | Where-Object {$_.Id -eq 4688}' and notices that a process named 'cmd.exe' was launched with the command line 'cmd /c vssadmin.exe delete shadows /all /quiet'. Which type of attack does this command indicate?

Accepted Answer

Ransomware deleting volume shadow copies to prevent recovery. The command 'vssadmin delete shadows /all /quiet' is a hallmark of ransomware, used to eliminate backup copies before encrypting files. It is often executed via cmd.exe in scripts. Detecting this command in process creation logs is a high-fidelity indicator of ransomware activity, allowing for immediate response.

Answer

A legitimate backup operation removing old shadow copies

Answer

A system administrator troubleshooting disk space issues

Answer

A malware family using shadow copy deletion for anti-forensics

Question 6

A security analyst is reviewing Windows Event Logs on a domain controller. The analyst sees multiple Event ID 4769 (Kerberos service ticket was requested) with the same user account but different service names, occurring in a short time frame. Which of the following attacks is MOST likely indicated?

Accepted Answer

Kerberoasting. Kerberoasting is an attack where an adversary requests Kerberos service tickets for service accounts and then cracks them offline. Event ID 4769 is generated for each TGS request. A burst of 4769 events with different service names from the same user is a strong indicator. Monitoring for such patterns helps detect Kerberoasting attempts.

Answer

Golden Ticket

Answer

Pass-the-Hash

Answer

DCSync

Question 7

A security analyst is reviewing a Windows system for signs of malware persistence. The analyst notices a suspicious executable named 'updater.exe' in the Startup folder. Which Windows feature is being abused by the malware in this scenario?

Accepted Answer

Startup Folder. The Startup folder is a well-known location that Windows uses to automatically launch programs when a user logs in. Malware frequently places a copy of itself or a shortcut in this folder to ensure it runs every time the user logs in. The presence of 'updater.exe' in the Startup folder indicates that this persistence mechanism is being abused. Other methods like Services, Task Scheduler, or Registry Run keys are also used by malware but are not described in this scenario.

Answer

Registry Run Keys

Answer

Windows Services

Answer

Task Scheduler

Question 8

An analyst is investigating a Linux web server that is exhibiting unusual outbound network traffic. The analyst runs 'lsof -i' and notices that the process 'apache2' has an established connection to an external IP address on port 4444. Further investigation shows that a file named 'update.php' in the web root contains obfuscated code. Which type of compromise does this most likely represent?

Accepted Answer

A web shell providing remote command and control. The combination of an outbound connection from the web server process on a common reverse shell port (4444) and an obfuscated PHP file in the web root is a classic indication of a web shell. Attackers use web shells to execute commands and maintain access, often leading to data exfiltration or further network compromise.

Answer

A scheduled backup process transferring data to a remote server

Answer

A legitimate plugin communicating with an update server

Answer

A misconfigured Apache module causing unexpected connections

Question 9

An analyst is examining a Windows system for evidence of credential dumping. The analyst runs 'Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688}' and filters for processes with 'lsass.exe' as the target. The output shows that a process named 'procdump.exe' was executed with the command line 'procdump.exe -ma lsass.exe lsass.dmp'. Which type of attack does this indicate?

Accepted Answer

Credential dumping via LSASS memory dump. Using procdump to dump LSASS memory is a well-known credential dumping technique. Attackers often rename procdump or use it directly to avoid detection. The resulting dump file can be exfiltrated and analyzed offline to extract credentials. Detecting this behavior involves monitoring for process creation of procdump.exe with lsass.exe as an argument, as well as other tools like Task Manager or comsvcs.dll.

Answer

A backup process capturing system state

Answer

A malware family using process injection into LSASS

Answer

A legitimate troubleshooting step to diagnose LSASS crashes

Question 10

An analyst is triaging a Windows 10 host and finds a scheduled task named 'MicrosoftEdgeUpdateTaskMachineUA' that runs a PowerShell script from C:\Users\Public\update.ps1 every 30 minutes. The script base64-decodes a payload and calls Invoke-WebRequest to a remote host. Which action should the analyst take FIRST to preserve evidence while containing the threat?

Accepted Answer

Capture volatile data including the running process list, network connections, and the contents of C:\Users\Public\update.ps1, then disable the scheduled task and isolate the host.. The order of volatility dictates that the most perishable evidence (memory, network state, running processes) is captured before less volatile evidence (disk files) and before any remediation. Capturing the script, process list, and connections first preserves investigative value; disabling the task and isolating the host then stops the beaconing without destroying evidence. Reboots, AV quarantine, and deletion all destroy or alter artifacts needed to scope the compromise.

Answer

Immediately reboot the host into Safe Mode to stop the PowerShell execution, then begin collecting forensic artifacts from the disk.

Answer

Run a full antivirus scan and allow it to quarantine any detected files, then review the scheduled task XML for indicators.

Answer

Delete the scheduled task and the update.ps1 file immediately, then capture a memory image of the host for offline analysis.

Question 11

A security analyst is investigating a Windows host for signs of fileless malware. The analyst runs a memory analysis tool and observes a process named 'powershell.exe' with a parent process of 'winword.exe'. The command line includes '-enc' followed by a long base64 string. Which technique is most likely being used by the attacker?

Accepted Answer

Malicious macro execution. The scenario describes winword.exe spawning powershell.exe with an encoded command, a hallmark of malicious macro execution. Attackers embed macros in Word documents that execute PowerShell to download or run payloads, often using base64 encoding to hide the script. Other techniques like DLL injection, process hollowing, or scheduled tasks do not match the observed parent-child relationship and command-line pattern, making macro execution the most likely.

Answer

Process hollowing

Answer

DLL injection

Answer

Scheduled task persistence

Question 12

A security analyst is investigating a Linux server that is suspected of hosting a reverse-shell backdoor. The analyst wants to identify which running process is maintaining the outbound connection and which user context it is running under. Which TWO commands would best provide this information? (Choose two.)

Accepted Answer

lsof -i -P -n. To attribute a suspicious outbound connection to a specific process and user, the analyst needs socket-to-process mapping. The ss command with -tunap and lsof with -i -P -n both provide this mapping by listing open sockets alongside the owning process and user. Static files such as /etc/passwd, resource monitors like top, and service logs from journalctl do not tie live connections to processes, so they cannot identify the reverse shell.

Answer

cat /etc/passwd

Answer

top -b -n 1

Answer

journalctl -u sshd --since '1 hour ago'

Question 13

A security analyst is reviewing a Windows 10 host for potential compromise. The analyst runs 'net user' and sees an account named 'Support' that was not created by IT. The account is a member of the local Administrators group. Which Windows Event ID should the analyst check to determine when this account was created?

Accepted Answer

4720. The analyst needs to determine when the unauthorized 'Support' account was created. Event ID 4720 is specifically logged when a user account is created, providing the account name, creator, and timestamp. Other events like 4722 (enabled), 4724 (password reset), and 4732 (added to group) do not indicate creation time. Therefore, 4720 is the correct event to review for account creation.

Answer

4722

Answer

4724

Answer

4732

Question 14

An analyst is examining a Windows 10 host and discovers that a service named 'WinDefendSvc' is registered with a binary path of C:\ProgramData\svchost.exe and a display name of 'Windows Defender Service'. The legitimate Windows Defender service uses a different name and binary path. Which conclusion is most accurate?

Accepted Answer

This indicates a masquerading attempt, because the service name mimics Windows Defender while its binary is placed in a user-writable directory, which is typical of malware persistence.. Legitimate Windows Defender registers as the WinDefend service with its binary under C:\Program Files\Windows Defender. A service named WinDefendSvc pointing to C:\ProgramData\svchost.exe combines two red flags: a typosquatted name impersonating a security product and a binary in a user-writable directory. This pattern is characteristic of masquerading persistence, and the analyst should investigate the binary, its signature, and its network activity rather than dismissing it as legitimate.

Answer

The service is a leftover from a Windows Update that failed to clean up and can be safely ignored, since the binary is named svchost.exe.

Answer

This is a benign third-party antivirus service that has registered itself under a Microsoft-like name to be trusted by the operating system.

Answer

This is a legitimate alternate Windows Defender service name used on some Windows 10 builds and should be verified with Get-Service before further action.

Question 15

An analyst is examining a Windows system for evidence of malware that maintains persistence by modifying the Image File Execution Options (IFEO) registry key. Which of the following best describes how this technique works?

Accepted Answer

The malware sets the 'Debugger' value for a legitimate process, causing the debugger to execute instead of the intended process.. Image File Execution Options (IFEO) is a registry key that allows setting a debugger for a specific executable. Malware abuses this by setting the Debugger value to its own binary, so when the targeted process is launched, the malicious debugger runs instead. This provides persistence and can be used to hijack trusted processes, making detection challenging.

Answer

The malware adds a new service that runs under the context of the SYSTEM account.

Answer

The malware creates a shortcut in the Startup folder to launch automatically.

Answer

The malware modifies the 'Shell' value in the Winlogon registry key to execute on user logon.