200-201 Host-Based Analysis Practice Test 2 — 15 Questions

Question 1

A Linux system administrator notices unauthorized SSH logins in /var/log/auth.log. Which of the following log entries would indicate a failed SSH login attempt?

Accepted Answer

Failed password for root. In auth.log, failed SSH logins typically contain 'Failed password' messages. Accepted password indicates success, and Invalid user may accompany failed attempts but the key indicator is 'Failed password'.

Answer

Connection closed by authenticating user

Answer

Session opened for user

Answer

Accepted publickey for root

Question 2

An analyst discovers an unknown process on a Windows host that has no parent process (PPID 0). What does this likely indicate?

Accepted Answer

The process is likely hidden or injected by malware.. A process with PPID 0 on Windows has no legitimate parent, which is abnormal because normal user and system processes are spawned by a parent (e.g., explorer.exe, services.exe, svchost.exe). Malware often uses process injection or hollowing techniques that orphan the process or set the parent PID to 0 to evade detection. This is a classic indicator of compromise in memory forensics.

Answer

The process is a child of the System Idle Process.

Answer

The process is a user-initiated task running normally.

Answer

The process is a legitimate system process started at boot.

Question 3

A security analyst is examining a Linux system suspected of compromise. Which THREE artifacts should be reviewed to identify potential persistence mechanisms?

Accepted Answer

Cron jobs in /etc/crontab and /var/spool/cron/. Cron jobs in /etc/crontab and /var/spool/cron/ (option C) are a classic persistence mechanism because attackers can schedule malicious commands or scripts to run automatically at recurring intervals or on reboot, and these locations cover both system-wide and per-user scheduled tasks. Bash history in /home/*/.bash_history (option D) is relevant because it can reveal the commands an intruder executed to establish persistence, such as creating backdoor accounts, downloading implants, or modifying startup files, even though it is more of an investigative lead than a persistence location itself. Systemd services in /etc/systemd/system/ (option E) are a common modern persistence vector since a malicious unit file placed there can start a backdoor automatically at boot or on a triggered event, and administrators often overlook custom units. Option A is not marked correct here because authorized_keys, while a well-known persistence vector, is not among the three artifacts this question expects. Option B is incorrect because /proc/cpuinfo merely exposes CPU hardware details and contains no persistence-related configuration or execution hooks.

Answer

Authorized SSH keys in ~/.ssh/authorized_keys

Answer

/proc/cpuinfo

Question 4

During a host-based analysis of a Windows system, an analyst finds a suspicious executable that runs every time the system boots. Which registry key is most commonly used for this type of persistence?

Accepted Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run is the classic autostart registry key that executes programs every time any user logs on, making it one of the most common persistence mechanisms for malware. It is widely abused because it requires no special privileges to write for administrators and is checked by Windows at every boot/logon. Analysts routinely inspect this key during host-based investigations.

Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\AppInit_DLLs

Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Image File Execution Options

Question 5

During a host-based analysis, an analyst discovers a suspicious service on a Windows machine. Which tool or command can be used to query the service configuration?

Accepted Answer

sc query. The 'sc query' command is used in Windows to query the status and configuration of services. It communicates with the Service Control Manager (SCM) and can display information about a specific service or list all services. For a suspicious service, 'sc query <servicename>' shows the service state (running/stopped) and other details, making it the correct tool for host-based analysis of service configuration.

Answer

reg query

Answer

schtasks

Answer

tasklist

Question 6

An analyst examines a Windows endpoint and finds a suspicious executable in the Startup folder. Which registry key is commonly used for persistence via legitimate startup programs and is often abused by malware?

Accepted Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. The registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run is a legitimate autostart location that malware frequently abuses for persistence. Programs listed here execute automatically when the user logs on, making it a common target for attackers to ensure their malicious code runs after reboots. This key is per-user and does not require administrative privileges to modify, making it an easy persistence mechanism.

Answer

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\

Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

Question 7

During incident response, a Linux server is found to have an unknown process listening on a high TCP port. The process is not listed in any systemd unit files. Which command will best help identify the process parent and its command-line arguments?

Accepted Answer

cat /proc/[pid]/cmdline && cat /proc/[pid]/status. The /proc filesystem exposes kernel-level process metadata. Reading /proc/[pid]/cmdline gives the exact command-line arguments used to launch the process (null-separated), while /proc/[pid]/status provides the PPid (parent PID), UID, GID, and process state. Together they let an analyst reconstruct the process lineage and execution context without relying on userland tools that a rootkit could have tampered with.

Answer

ps aux | grep [pid]

Answer

journalctl -u unknown.service

Answer

ss -tlnp | grep [pid]

Question 8

An analyst is reviewing a memory dump using Volatility. They want to identify processes with potential code injection. Which TWO Volatility plugins would be most appropriate for detecting injected code?

Accepted Answer

dlllist. Option E, malfind, is specifically designed to detect injected code by scanning process memory for regions with suspicious characteristics such as PAGE_EXECUTE_READWRITE permissions and MZ headers that are not backed by a file on disk, making it the primary plugin for this task. Option B, dlllist, is also appropriate because it enumerates the loaded modules (DLLs) for each process, allowing the analyst to spot unexpected or anomalous DLLs that may indicate injected code or DLL hijacking. Option A, cmdline, only shows process command-line arguments and cannot reveal in-memory code injection. Option C, netscan, focuses on network connections and sockets, which is unrelated to detecting injected code. Option D, pslist, merely lists active processes via the process list and does not inspect memory for injected regions, so it would not identify injection artifacts.

Answer

cmdline

Answer

netscan

Answer

pslist

Question 9

During a Linux forensic investigation, an analyst finds a suspicious process. The analyst wants to check for persistence mechanisms. Which THREE Linux artifacts should be examined?

Accepted Answer

/etc/crontab and /var/spool/cron/. Cron jobs, systemd services, and bash history are common artifacts for persistence. Cron and systemd can schedule execution, bash history may show past commands.

Answer

/var/log/auth.log

Answer

/proc/net/tcp

Question 10

An analyst is examining a suspicious executable file. The file has a .pdf extension but the magic bytes are 'MZ'. Which THREE indicators suggest the file is malicious?

Accepted Answer

The file imports functions like URLDownloadToFile. Magic bytes MZ indicate PE, high entropy suggests packing, suspicious imports (e.g., URLDownloadToFile) are common in malware.

Answer

The file has a valid Authenticode signature

Answer

The file has a low entropy value (e.g., 2.5)

Question 11

During a Linux incident response, an analyst runs 'ps aux' and sees a process with a suspicious name. The analyst wants to gather more information. Which TWO commands can provide the process's network connections?

Accepted Answer

cat /proc/[pid]/net/tcp. ss -tlnp shows listening TCP sockets with the process PID. /proc/[pid]/net/tcp contains TCP connection info for that process.

Answer

lsof -i

Answer

cat /var/log/syslog

Answer

netstat -antp

Question 12

An analyst is investigating a Windows system using prefetch files. The analyst notices a prefetch file for a tool called 'procdump.exe' with a run count of 1 and the last run time corresponding to the time of the incident. Which THREE conclusions can be drawn?

Accepted Answer

The tool was executed from a specific file path. Option B is correct because a Windows prefetch file is named after the executable and stored in C:\Windows\Prefetch with a name derived from the full path of the executable (e.g., PROCDUMP.EXE-<hash>.pf), so the hash-encoded filename reveals the specific file path from which procdump.exe was launched. Option C is correct because the mere existence of a prefetch file for procdump.exe proves the executable ran at least once on the system; prefetch files are created only upon execution. Option E is correct because the prefetch run count field increments each time the executable is launched, so a run count of 1 indicates the tool was executed exactly once, consistent with the last run time matching the incident. Option A is not correct because prefetch files do not record the parent process that spawned the executable; that information would come from sources such as Sysmon, Security 4688 events, or process-tracking artifacts. Option D is not correct because prefetch does not store command-line arguments; those would need to be recovered from sources like ShimCache, AmCache, or process creation logs.

Answer

The parent process that launched the tool is identified

Answer

The tool was executed with specific command-line arguments

Question 13

A security analyst is reviewing a Linux server that is suspected of being compromised. The analyst notices an unusual process with PID 4321 that has a parent process of PID 1 (init/systemd). Which of the following commands would BEST help the analyst determine the executable path and command-line arguments used to launch this process?

Accepted Answer

cat /proc/4321/cmdline. The /proc filesystem provides detailed information about running processes. Reading /proc/4321/cmdline yields the exact command line, including the executable and all arguments, which is essential when investigating a process with an anomalous parent like PID 1. This helps determine if the process was started by a malicious script or service.

Answer

lsof -p 4321

Answer

ps -p 4321 -o pid,ppid,cmd

Answer

ls -l /proc/4321/exe

Question 14

A security analyst is reviewing a suspicious Windows workstation. The user reported that a document opened normally but then the system became slow and a new service named 'WinUpdateSvc' appeared. The analyst wants to determine the exact command line used to start this service. Which artifact should the analyst examine?

Accepted Answer

Windows Security event log, Event ID 4688. The analyst needs the exact command line used to start the suspicious service. Windows Security Event ID 4688, when command-line auditing is enabled, records process creation and includes the full command line. This directly answers the question, whereas other events provide installation details, crash data, or malware alerts without command-line context.

Answer

System event log, Event ID 7045

Answer

Application event log, Event ID 1000

Answer

Windows Defender operational log, Event ID 1116

Question 15

A security analyst is investigating a compromised Linux web server. The analyst runs `ps -ef` and notices a process named `kworker` with PID 9876 that is consuming 95% CPU and has a parent PID of 1. However, the analyst recalls that legitimate `kworker` processes are kernel threads and should not have a parent PID of 1. Which of the following commands would BEST help the analyst determine if this process is malicious?

Accepted Answer

`ls -l /proc/9876/exe`. On Linux, kernel threads appear in `ps` with names like kworker and have no executable file. The `/proc/<pid>/exe` symlink points to the executable image for user-space processes. For a kernel thread, this link is empty or points to `/`. If a process named kworker has a valid exe link to a file in /tmp or elsewhere, it is almost certainly malware masquerading as a kernel thread. Checking this link directly answers whether the process is legitimate.

Answer

`lsof -p 9876`

Answer

`cat /proc/9876/status`

Answer

`strace -p 9876`