200-201 Host-Based Analysis Practice Test 3 — 15 Questions

Question 1

A security analyst is investigating a Windows host suspected of malware infection. Which tool would allow the analyst to view parent-child relationships of running processes and inspect command line arguments?

Accepted Answer

Process Explorer. Process Explorer provides detailed process tree view and command line information, unlike Task Manager's default view or tasklist.

Answer

Task Manager

Answer

tasklist command

Answer

Resource Monitor

Question 2

During a host-based analysis, a Windows system is found to have a suspicious service that starts automatically. Which command-line tool can be used to query the status and configuration of services, particularly to identify non-standard service names or paths?

Accepted Answer

sc query. sc query displays detailed service information including name, display name, and binary path.

Answer

services.msc

Answer

tasklist /svc

Answer

net start

Question 3

An analyst discovers that a Windows system executes a payload each time a user logs in, even before the desktop appears. Which registry key is most likely used for such persistence, and why would it be harder to detect than typical Run keys?

Accepted Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs. AppInit_DLLs loads DLLs into every process that loads user32.dll, making it a stealthy persistence mechanism.

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Question 4

A Windows event log review shows Event ID 4625 multiple times from a single source IP. What does this event indicate, and which log contains it?

Accepted Answer

Failed logon; Security log. Event ID 4625 is a failed logon attempt, recorded in the Security log.

Answer

Successful logon; System log

Answer

Service start; System log

Answer

Account creation; Application log

Question 5

In Linux forensics, which file would an analyst check to see command history of a user, potentially revealing malicious commands executed?

Accepted Answer

/home/user/.bash_history. Bash history is stored in ~/.bash_history for each user.

Answer

/etc/passwd

Answer

/proc/net/tcp

Answer

/var/log/auth.log

Question 6

An analyst uses Volatility on a memory dump and runs the 'pstree' command. What specific information does this provide compared to 'pslist'?

Accepted Answer

It displays the process tree hierarchy.. pstree shows parent-child relationships between processes, which pslist does not.

Answer

It shows only hidden processes.

Answer

It extracts command line arguments.

Answer

It lists loaded kernel modules.

Question 7

When analyzing a suspicious PE file, the analyst calculates the file's entropy and finds it to be 7.8. What does a high entropy value typically indicate, and why is it relevant to malware analysis?

Accepted Answer

The file is likely packed or encrypted to evade signature-based detection.. A high entropy value (close to 8.0) indicates that the data within the file is highly random, which is a strong sign of packing or encryption. Malware authors use packers to obfuscate the original executable code, making it harder for signature-based detection engines to identify known malicious patterns. In malware analysis, entropy is a quick heuristic to flag files that may be hiding their true content.

Answer

The file contains no executable code.

Answer

The file is likely a legitimate application with high compression.

Answer

The file's imports are all standard Windows DLLs.

Question 8

A Linux analyst wants to identify all listening TCP ports on a system. Which command is most appropriate?

Accepted Answer

ss -tlnp. ss -tlnp shows listening TCP sockets with process info.

Answer

netstat -an

Answer

lsof -i

Answer

ps aux

Question 9

In Windows, prefetch files (C:\Windows\Prefetch\*.pf) are used by the system to speed up application loading. How can an analyst leverage prefetch files during host-based analysis?

Accepted Answer

They provide evidence of file execution, including frequency and timestamps.. Prefetch files in Windows record metadata about application launches, including the executable path, run count, and last run timestamp. During host-based analysis, an analyst can examine these .pf files to determine which executables have been executed, how often, and when, providing crucial evidence of file execution activity.

Answer

They store network connection logs.

Answer

They store registry keys modified by the application.

Answer

They contain the contents of the running process memory.

Question 10

An analyst examining a Linux server notices an unusual cron job in /etc/crontab that runs a script every 5 minutes. Which of the following describes the best approach to determine if this cron job is malicious?

Accepted Answer

Check the script's content, owner, and compare its hash with known threats.. Inspecting the script content and correlating with known persistence techniques helps assess maliciousness.

Answer

Ignore it because cron jobs are always legitimate.

Answer

Delete the cron job immediately to stop potential malicious activity.

Answer

Run the script in a sandbox to see what it does.

Question 11

A Windows system's security log shows Event ID 4720 followed by 4726 for the same username within minutes. What does this sequence indicate?

Accepted Answer

An account was created and then deleted, possibly for short-term unauthorized access.. Event 4720 is account creation, 4726 is deletion; rapid sequence suggests temporary account used for malicious activity.

Answer

A user changed their password.

Answer

The account was successfully logged on.

Answer

A group membership was changed.

Question 12

When performing file analysis, which method is most reliable for determining the actual file type regardless of its extension?

Accepted Answer

Examining the file's magic bytes. Magic bytes (or file signatures) are unique byte sequences at the beginning of a file that identify its format regardless of the file extension. This method is reliable because it examines the actual binary content, such as the 'PK' header for ZIP files or '‰PNG' for PNG images, rather than relying on user-assigned metadata that can be easily changed.

Answer

Opening the file in a text editor

Answer

Checking the file extension

Answer

Checking the file size

Question 13

An analyst is investigating a Windows host for malware persistence. Which TWO registry locations are commonly abused for persistence by modifying the 'Run' key? (Select TWO)

Accepted Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\Run. Both HKLM and HKCU Run keys are commonly used for persistence.

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

Answer

HKLM\System\CurrentControlSet\Services

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

Question 14

A Linux server has been compromised. The analyst checks for persistence mechanisms. Which THREE of the following are common Linux persistence techniques that should be examined? (Select THREE)

Accepted Answer

Creating a systemd service unit. Creating a systemd service unit is a common Linux persistence technique because systemd is the default init system for most modern Linux distributions. An attacker can place a malicious service file (e.g., /etc/systemd/system/evil.service) that automatically starts the malware at boot or after a crash, ensuring continued access even after a reboot.

Answer

Changing the system timezone

Answer

Modifying the /etc/hosts file

Question 15

During memory analysis using Volatility, an analyst suspects code injection. Which THREE commands would be most useful to identify injected code? (Select THREE)

Accepted Answer

malfind. malfind detects injected code, dlllist/ldrmodules show loaded modules anomalies, and pslist/pstree identify suspicious processes.

Answer

netscan

Answer

hashdump