200-201 Host-Based Analysis Practice Test 2 — 15 Questions

Question 1

An analyst is investigating a Windows system for signs of malware persistence. Which registry key is commonly used by malware to run automatically at user logon?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a common persistence location for user-level autoruns.

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

Question 2

During incident response on a Linux server, an analyst runs 'ss -tlnp' and sees an SSH service listening on a non-standard high port. Which step should the analyst take next to investigate potential unauthorized access?

Accepted Answer

Examine /var/log/auth.log for successful logins.. Checking /var/log/auth.log for successful SSH logins on that port helps identify unauthorized connections.

Answer

Review the bash history of root user.

Answer

Check /etc/crontab for malicious scheduled tasks.

Answer

Run 'ps aux' to list all processes.

Question 3

An analyst is analyzing a suspicious executable file. Using the 'file' command, it returns 'data' instead of 'PE32 executable'. What is the most likely reason?

Accepted Answer

The file has been packed or encrypted to hide its true nature.. The 'data' result indicates the file's magic bytes do not match known executables, suggesting it might be packed or obfuscated.

Answer

The system is missing the file command database.

Answer

The file is a legitimate PE file with a different extension.

Answer

The file is actually a script written in Python.

Question 4

A forensic analyst uses Volatility on a memory dump and runs the 'malfind' plugin. The output shows a process with a VAD region that has PAGE_EXECUTE_READWRITE protection and contains the pattern 'MZ'. What does this indicate?

Accepted Answer

The process has been infected with code injection, likely a PE executable mapped in memory.. PAGE_EXECUTE_READWRITE protection combined with 'MZ' header suggests code injection, where a malicious executable has been written into the process memory.

Answer

The process is using a packed executable that was unpacked in memory.

Answer

The process has a heap spray attack, but not necessarily injected code.

Answer

The process is a legitimate browser with dynamic code.

Question 5

Which Windows Event ID is recorded when a user account is created, indicating potential unauthorized account creation?

Accepted Answer

4720. Event ID 4720 is logged when a user account is created in Active Directory or local SAM.

Answer

4726

Answer

4648

Answer

4624

Question 6

An analyst finds a suspicious service named 'UpdateSvc' running on a Windows system. Which tool or command would best help determine the service's binary path and start type?

Accepted Answer

sc query UpdateSvc. The 'sc query' command with the service name provides detailed information including binary path and start type.

Answer

net start

Answer

tasklist /svc

Answer

Get-Service UpdateSvc

Question 7

A Linux analyst notices a process named '[kworker/1:1+events]' in the process list with high CPU usage. Which further analysis step would help determine if this is a legitimate kernel worker or a rootkit hiding as one?

Accepted Answer

Check /proc/[pid]/cmdline; if empty, it is likely a kernel thread, otherwise it is a user-space process masquerading.. Checking /proc/[pid]/cmdline for the process ID can reveal if it has a command line; legitimate kernel threads have empty cmdline, while user-space processes do not.

Answer

Run 'ls -la /proc/[pid]/exe' to see the symbolic link target.

Answer

Examine /var/log/syslog for kernel messages.

Answer

Use 'strace' to trace system calls of the process.

Question 8

Which Windows Prefetch file extension indicates that a program has been executed on the system?

Accepted Answer

.pf. Prefetch files have the .pf extension and contain execution data for applications.

Answer

.evtx

Answer

.tmp

Answer

.log

Question 9

An analyst finds an unknown scheduled task on a Windows system that runs a PowerShell script at system startup. Which tool is best for examining the task's trigger and actions?

Accepted Answer

Task Scheduler. Task Scheduler (taskschd.msc) provides a GUI to view all scheduled tasks, their triggers, and actions.

Answer

Services.msc

Answer

Event Viewer

Answer

Registry Editor

Question 10

During memory analysis with Volatility, the 'pstree' plugin shows a parent process of 'winlogon.exe' spawning 'cmd.exe'. What is the most likely explanation for this anomaly?

Accepted Answer

A debugger or persistence mechanism like Image File Execution Options has replaced sethc.exe with cmd.exe.. Normally, winlogon.exe does not spawn cmd.exe; this could indicate a 'sticky keys' (sethc.exe) persistence or other accessibility tool abuse where cmd.exe replaces the debugger.

Answer

This is a normal occurrence when a user opens cmd after logging in.

Answer

A user is running a command prompt from the Windows login screen.

Answer

The cmd.exe is a system process running under winlogon's session.

Question 11

Which Linux log file is most appropriate for reviewing failed SSH login attempts?

Accepted Answer

/var/log/auth.log. /var/log/auth.log (or /var/log/secure on some distributions) records authentication events including SSH failures.

Answer

/var/log/messages

Answer

/var/log/kern.log

Answer

/var/log/syslog

Question 12

An analyst is examining a PE file and notices that the 'TimeDateStamp' in the optional header is 0x00000000. What does this suggest?

Accepted Answer

The timestamp has been deliberately erased or not set, possibly to avoid forensic analysis.. A timestamp of zero often indicates the linker did not set it, which is common for malware or files compiled with certain tools that omit the timestamp.

Answer

The file is digitally signed.

Answer

The file was compiled on January 1, 1970 (Unix epoch).

Answer

The file is a DLL rather than an executable.

Question 13

An analyst is investigating a Linux system for persistence mechanisms. Which TWO of the following are common locations for cron-based persistence? (Select TWO)

Accepted Answer

/var/spool/cron/crontabs/. Crontabs for users are stored in /var/spool/cron/crontabs/ and system-wide cron jobs are in /etc/crontab.

Answer

/etc/init.d/

Answer

/var/log/cron

Answer

/etc/systemd/system/

Question 14

During memory analysis using Volatility, an analyst wants to identify processes with suspicious network connections and potentially injected code. Which THREE plugins should the analyst use? (Select THREE)

Accepted Answer

pstree. pstree shows process hierarchy, netscan lists network connections, and malfind detects injected code.

Answer

hashdump

Answer

hivelist

Question 15

An analyst is examining a Windows system for evidence of privilege escalation or credential theft. Which THREE Event IDs should the analyst focus on in the Security log? (Select THREE)

Accepted Answer

4648. Event ID 4648 (A logon was attempted using explicit credentials) is correct because it records when a user explicitly provides credentials to run a program or service, which is a common technique in privilege escalation (e.g., runas) and credential theft (e.g., pass-the-hash). This event captures the target account, source process, and target workstation, making it invaluable for detecting lateral movement or credential misuse.

Answer

4720

Answer

4625