200-201 Host-Based Analysis Practice Test 3 — 15 Questions

Question 1

An incident responder is examining a Windows host where an attacker reportedly used a signed Microsoft binary to execute arbitrary code, a technique known as living-off-the-land binary (LOLBin) abuse. The responder wants to reconstruct the exact command line that was passed to the binary. Which Windows artifact provides the most reliable record of executed process command lines?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Security Event ID 4688 with command-line auditing enabled. Security Event ID 4688 is generated by the Windows kernel on every process creation and, once command-line auditing is enabled through the Audit Process Creation policy and the Include command line setting, it embeds the full command line and parent process. That makes it the native, authoritative artifact for reconstructing how a signed binary was invoked. Sysmon offers similar data but depends on prior deployment, which the scenario does not establish.

Answer

Sysmon Event ID 1 process creation records

Answer

Windows Event ID 4689 process termination records

Answer

Prefetch files parsed with PECmd

Question 2

A security analyst is examining a Windows 10 workstation that is suspected of being infected with malware. The analyst wants to check the Windows Defender Antivirus scan history to see if any threats were detected and quarantined. Which Windows event log and event ID should the analyst review?

Accepted Answer

Microsoft-Windows-Windows Defender/Operational log, Event ID 1117. To confirm that Windows Defender detected and quarantined a threat, the analyst should look for Event ID 1117 in the Windows Defender Operational log. This event specifically records remediation actions taken against detected malware, including quarantine. Other event IDs indicate detection, protection status changes, or configuration, but not the quarantine action itself.

Answer

Microsoft-Windows-Windows Defender/Operational log, Event ID 1116

Answer

Microsoft-Windows-Windows Defender/Operational log, Event ID 1006

Answer

Microsoft-Windows-Windows Defender/Operational log, Event ID 5001

Question 3

A security analyst is investigating a Linux web server that is exhibiting unusual outbound network traffic. The analyst suspects a compromised process is communicating with a command-and-control server. Which command should the analyst use to identify the process ID associated with a specific network connection?

Accepted Answer

ss -tnp. The analyst needs to map an active network connection to a local process. The ss command with -tnp options shows TCP connections, numerical addresses, and the process ID and name. This directly reveals which process is communicating with the suspicious external address. Other tools either show listening ports, require additional correlation, or lack process association.

Answer

tcpdump -i eth0

Answer

netstat -tulpn

Answer

lsof -i

Question 4

A security analyst is examining a Windows 10 host for evidence of credential theft. The analyst suspects that an attacker used Mimikatz to extract credentials from memory. Which TWO of the following Windows Event Log entries would be most indicative of this activity? (Choose two.)

Accepted Answer

Event ID 4688 with process creation of 'mimikatz.exe'. Mimikatz extracts credentials by accessing the memory of lsass.exe. Event ID 4656 with a handle to lsass.exe indicates an attempt to access LSASS, which is a key detection. Event ID 4688 can log the execution of mimikatz.exe if process creation auditing is enabled. Together, these events provide strong evidence of credential theft activity.

Answer

Event ID 4625 with failure reason 'Unknown user name or bad password'

Answer

Event ID 4624 with Logon Type 3 (Network)

Answer

Event ID 7045 with service name 'PSEXESVC'

Question 5

During host-based analysis of a Windows 10 endpoint, a CyberOps analyst finds an unfamiliar service named 'WinDefendHelper' configured with Start=2 in the registry under HKLM\SYSTEM\CurrentControlSet\Services. The analyst wants to determine whether this service is currently loaded and running in memory. Which native Windows tool should the analyst use to enumerate loaded kernel drivers and services in real time?

Accepted Answer

Process Explorer with the lower pane set to show DLLs and the option to display kernel modules.. Confirming whether a suspicious service is active requires a live view of loaded kernel modules, not just configuration. Process Explorer's kernel module view reveals what is actually resident in memory, so it can confirm a driver is loaded even if the service record is misleading or the driver was mapped outside normal service control. Configuration-only tools leave that gap.

Answer

driverquery.exe with the /v and /fo list switches.

Answer

sc.exe query WinDefendHelper and sc.exe qc WinDefendHelper.

Answer

Autoruns (autorunsc.exe) with the -h -s -v options.

Question 6

A security analyst is reviewing a Linux system's authentication logs and notices multiple entries similar to 'Failed password for invalid user admin from 192.168.1.100 port 54321 ssh2'. The analyst wants to determine the source of these attempts. Which log file is the analyst most likely reviewing?

Accepted Answer

/var/log/auth.log. The log entries 'Failed password for invalid user' are characteristic of SSH authentication failures. On Debian-based Linux systems, these are recorded in /var/log/auth.log. This file is the primary source for authentication-related events, including SSH logins, sudo usage, and other authentication activities. Reviewing auth.log helps analysts detect brute-force attacks and unauthorized access attempts.

Answer

/var/log/secure

Answer

/var/log/syslog

Answer

/var/log/messages

Question 7

A SOC analyst receives an alert about suspicious outbound traffic from a Windows 10 workstation. The analyst suspects a malicious process is running but cannot identify it in Task Manager. Which tool should the analyst use to enumerate running processes with their associated command-line arguments and parent-child relationships?

Accepted Answer

Wmic process get ProcessId,ParentProcessId,CommandLine. The analyst needs to enumerate processes with their command lines and parent-child relationships to trace suspicious outbound traffic. Wmic process get ProcessId,ParentProcessId,CommandLine retrieves this information directly from WMI, providing a scriptable and comprehensive view. Other tools like Tasklist or Netstat lack command-line or parent PID data, and Process Explorer, while useful, is GUI-based and not ideal for this specific enumeration requirement.

Answer

Netstat -ano

Answer

Tasklist

Answer

Process Explorer

Question 8

A security analyst is examining a Windows 10 host for signs of credential theft. The analyst suspects that the attacker used a tool like Mimikatz to dump credentials from memory. Which TWO Windows Event IDs are most relevant to investigate for evidence of credential dumping activity? (Choose two.)

Accepted Answer

Event ID 4663. Event IDs 4656 and 4663 are directly related to object access auditing, which can detect attempts to access the LSASS process memory. Credential dumping tools like Mimikatz often open a handle to LSASS with read access, triggering these events. By enabling audit policies for object access and process access, analysts can identify such suspicious access. Other events like 4624, 4688, and 4768 provide context but are not as specific to the act of credential dumping.

Answer

Event ID 4768

Answer

Event ID 4624

Answer

Event ID 4688

Question 9

A security analyst is examining a Windows 10 endpoint for signs of credential theft. The analyst suspects that a malicious actor used a technique to dump credentials from memory. Which TWO of the following artifacts or indicators would be most relevant to investigate this suspicion? (Choose two.)

Accepted Answer

Windows Security Event ID 4688 with process creation for 'lsass.exe' by a non-system process.. Credential dumping from memory often involves accessing the lsass process. Monitoring for unusual process creation of lsass.exe and the presence of memory dump files like lsass.dmp are direct indicators. These artifacts can be found through process monitoring and file system analysis, respectively. They are more specific to credential theft than generic logon events or scheduled tasks.

Answer

Windows Security Event ID 4624 with logon type 3 from a remote IP address.

Answer

A scheduled task that runs 'powershell.exe -EncodedCommand' at system startup.

Answer

Windows Defender Antivirus log showing a detected threat named 'Mimikatz'.

Question 10

An analyst is reviewing a Windows 10 endpoint suspected of compromise. The analyst runs 'wmic process get name,processid,parentprocessid,commandline' and notices that lsass.exe has a parent process ID that belongs to a Microsoft Word document process. Which finding best describes what this indicates?

Accepted Answer

Word spawned lsass.exe, indicating a credential-dumping technique where the malicious macro launched a fake lsass process to harvest credentials.. LSASS is a protected Windows process always created by wininit.exe at boot; it should never appear as a child of an application such as Word. When lsass.exe shows a productivity-application parent, the analyst should suspect process injection, masquerading, or credential-dumping tooling. The unusual parent-child tree is a classic host-based indicator of compromise that warrants memory capture and deeper investigation of the Word process and its loaded modules.

Answer

This is normal because Windows Word uses lsass.exe to authenticate the user when opening a protected document.

Answer

Word is performing a COM surrogate call that legitimately launches lsass.exe as a child to support document rendering.

Answer

The PID reuse feature in Windows caused the parent PID to be reassigned to Word, so this is a false positive.

Question 11

A forensic analyst is examining a Windows 10 image and finds that a suspicious executable was deleted from the file system. The analyst wants to determine whether the file was actually executed on the host and, if so, when. Which artifact should the analyst examine to obtain the most direct evidence of execution and its timestamp?

Accepted Answer

Windows Prefetch files in C:\Windows\Prefetch. Prefetch files are generated by the Windows Prefetcher when an executable is run, and each .pf file stores the executable name, a last-run timestamp in its header, and lists of referenced files and volumes. Finding a Prefetch file that matches a deleted executable is direct evidence the binary executed, and the header timestamp shows when. The other artifacts reveal file existence or GUI launch history but not reliable kernel-level execution of a command-line binary.

Answer

The UserAssist registry keys under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

Answer

The NTFS USN journal ($UsnJrnl)

Answer

The $MFT record for the deleted file

Question 12

A security analyst is examining a Linux server that may have been compromised. The analyst wants to identify which user account was used to execute a suspicious binary. Which file should the analyst review to see the most recent login times and source IP addresses for user accounts?

Accepted Answer

/var/log/auth.log. The analyst needs to identify which user account was used to execute a suspicious binary, requiring successful login records with source IPs. /var/log/auth.log captures authentication events including successful logins, usernames, and source IP addresses, making it the correct choice. Other logs like syslog are too broad, lastlog lacks IPs and history, and btmp only records failed attempts, so they do not meet the requirement.

Answer

/var/log/btmp

Answer

/var/log/syslog

Answer

/var/log/lastlog

Question 13

A SOC analyst is reviewing a Linux web server that has been defaced. The analyst wants to determine which user account was used to log in just before the defacement and from what source address. Which artifact would provide this information most directly?

Accepted Answer

/var/log/wtmp, which records successful login sessions with user, terminal, and source IP, and can be read using the last command.. Successful interactive logins on Linux are recorded in the binary wtmp file, which is queried with the 'last' command and reports username, terminal, source host, and login/logout times. This makes wtmp the most direct artifact for tying a specific account and origin address to the session preceding the defacement. Companion files like btmp (failed logins) and lastlog (per-user last login time) complement but do not replace wtmp for this question.

Answer

/var/log/secure, which contains only kernel messages and is the authoritative source for successful user logins on Linux.

Answer

/var/log/lastlog, which stores the most recent login time for every user and includes the source IP address of each connection.

Answer

/var/log/btmp, which records failed login attempts and can be reviewed with the lastb command to identify the source of the defacement.

Question 14

An analyst is investigating a Linux server and notices that the file '/etc/passwd' has been modified. The analyst runs 'stat /etc/passwd' and observes that the 'Modify' time is recent, but the 'Change' time is older. What does this discrepancy most likely indicate?

Accepted Answer

The file's timestamps were manipulated, possibly to hide recent unauthorized changes.. On Linux, the Modify time (mtime) reflects the last time file content changed, while the Change time (ctime) reflects the last time the inode metadata (including permissions, ownership, or timestamps) changed. Normally, modifying content updates both, with ctime >= mtime. If mtime is newer than ctime, it indicates that the timestamps were likely altered manually, which is suspicious and suggests an attempt to conceal activity.

Answer

The file is a symbolic link, and the timestamps refer to the target file.

Answer

The file's content was modified, but its metadata (such as permissions or ownership) was not changed.

Answer

The file's metadata was changed, but its content was not modified.

Question 15

A security analyst is investigating a Linux host for signs of a user-mode rootkit. The analyst suspects that the rootkit is hiding files and processes by hooking system calls. Which TWO of the following techniques would be MOST effective for detecting the presence of such a rootkit? (Choose two.)

Accepted Answer

Running `chkrootkit` and `rkhunter` to scan for known rootkit signatures.. User-mode rootkits often hook system calls to hide files and processes. Comparing `ps` with `/proc` reveals discrepancies because `ps` uses hooked calls while `/proc` is kernel-generated. Tools like `chkrootkit` and `rkhunter` scan for known rootkit artifacts and anomalies. Together, these methods effectively detect such rootkits.

Answer

Using `strace` to trace the `init` process and look for suspicious system calls.

Answer

Checking the integrity of system binaries using a package manager like `rpm -Va` or `debsums`.

Answer

Analyzing network traffic for unusual outbound connections using `tcpdump`.