200-201 Host-Based Analysis Practice Test 4 — 15 Questions

Question 1

A security analyst is investigating a Linux server that is suspected of being compromised. The analyst runs 'ps aux' and notices a process with a suspicious name running as root. The analyst wants to gather more information about this process to determine if it is malicious. Which TWO commands should the analyst use to examine the process's open files and its parent process ID? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

lsof -p . The analyst needs to examine the suspicious process's open files and parent process ID. 'lsof -p ' lists open files, including network sockets and accessed files, which can reveal malicious behavior. 'cat /proc//status' includes the PPid field, providing the parent process ID to trace the process's origin. Other commands like 'ps -ef | grep', 'netstat', and 'top' do not provide these specific details, making them less suitable for this investigation.

Answer

netstat -tulpn

Answer

top -p <PID>

Answer

ps -ef | grep <PID>

Question 2

A security analyst is investigating a Linux server that is suspected of being compromised. The analyst runs 'ps aux' and notices a process with a suspicious name running as root. The analyst wants to gather more information about this process to determine if it is malicious. Which TWO commands should the analyst use to examine the process's open files and its parent process ID? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

lsof -p 5678 -a -i. To map a socket file descriptor from /proc/PID/fd to a network connection, lsof is the most direct tool. Using 'lsof -p PID -a -i' filters the output to show only network files for that process, displaying the file descriptor, local and remote addresses, and connection state. This allows the analyst to quickly identify the suspicious connection.

Answer

netstat -tulpn | grep 5678

Answer

ss -p | grep 5678

Answer

cat /proc/5678/net/tcp

Question 3

A security analyst is analyzing a suspicious PE file. Using a hex editor, the analyst sees the MZ header (4D 5A). The file's entropy is calculated as 7.8. What does the high entropy most likely indicate?

Accepted Answer

The file is likely packed or obfuscated. High entropy (close to 8) suggests the file is packed or encrypted, as compressed or encrypted data has high randomness. This is often used by malware to evade signature detection.

Answer

The file is a legitimate signed binary

Answer

The file is corrupted

Answer

The file contains mostly plain text strings

Question 4

A Linux administrator checks authentication logs to investigate a possible brute-force attack. Which log file typically contains records of successful and failed SSH login attempts?

Accepted Answer

/var/log/auth.log. On Debian/Ubuntu Linux systems, /var/log/auth.log records authentication-related events including successful and failed SSH logins, sudo usage, and PAM activity. It is the primary log file for investigating brute-force attacks against SSH. This matches the question's requirement.

Answer

/var/log/kern.log

Answer

/var/log/messages

Answer

/var/log/syslog

Question 5

A Windows Event Log shows Event ID 4625 multiple times from the same source IP address. What type of activity does this indicate?

Accepted Answer

Failed logon attempts indicating a possible brute-force attack. Event ID 4625 indicates a failed logon attempt. Multiple failures from the same source suggest a brute-force attack.

Answer

Successful logon after multiple attempts

Answer

Credential validation by a domain controller

Answer

A user account was created

Question 6

An analyst is examining a suspicious file that appears to be a PDF but when checking the magic bytes at offset 0, sees '50 4B 03 04'. What does this indicate?

Accepted Answer

The file is a ZIP archive. The magic bytes '50 4B 03 04' at offset 0 are the ZIP file signature (PK\x03\x04). A genuine PDF must begin with '%PDF' (hex 25 50 44 46). Since the file claims to be a PDF but its header identifies it as a ZIP archive, this is a classic file-extension spoofing or polyglot technique used by malware to evade detection.

Answer

The file is a genuine PDF file

Answer

The file is a plain text file

Answer

The file is an executable

Question 7

An analyst uses 'sc query' on a Windows host and finds a service named 'WindowsUpdate' with a binary path pointing to 'C:\Users\Public\update.exe'. The service is running. Why is this suspicious?

Accepted Answer

The binary path is not in a system directory. Legitimate Windows services, especially those mimicking system components like Windows Update, should have their binary paths in protected system directories (e.g., C:\Windows\System32). A binary path pointing to C:\Users\Public\update.exe indicates the executable is in a user-writable location, which is a common technique used by malware to evade detection and maintain persistence. The 'sc query' command reveals the service configuration, and this abnormal path is a strong indicator of compromise.

Answer

The service is running

Answer

The service name is misspelled

Answer

The service displays 'WindowsUpdate'

Question 8

Which Windows artifact stores evidence of file execution, including the path and run count, and is located in C:\Windows\Prefetch?

Accepted Answer

Prefetch files. Windows Prefetch files, stored in C:\Windows\Prefetch with a .pf extension, record evidence of program execution including the executable path, run count, and timestamps of recent executions. Forensic analysts use them to prove that a binary ran on a system and how many times. This directly matches the artifact described in the question.

Answer

Windows Event Logs

Answer

Registry hives

Answer

Scheduled tasks

Question 9

A Linux host has an unusual cron job that runs a script from /tmp every minute. The analyst checks /etc/crontab and /var/spool/cron/ but finds nothing. Where else could the cron job be defined?

Accepted Answer

/etc/cron.d/. The cron job is defined in /etc/cron.d/ because this directory allows system administrators to drop individual cron configuration files that are parsed by the cron daemon. Unlike /etc/crontab and /var/spool/cron/ (which contain user-specific crontabs), /etc/cron.d/ is a standard location for package-maintained or custom cron jobs that run with system privileges. The fact that the analyst found nothing in the other two locations strongly suggests the job is defined in /etc/cron.d/.

Answer

/etc/cron.hourly/

Answer

/etc/cron.allow

Answer

~/.bashrc

Question 10

An analyst uses Volatility's 'netscan' on a memory dump and finds an established connection to an external IP on port 4444. Which type of activity is this commonly associated with?

Accepted Answer

Reverse shell or backdoor. Port 4444 is commonly used by Metasploit and other remote access tools for reverse shells. An established connection to an external IP on this port is indicative of a backdoor or command-and-control communication.

Answer

Email communication

Answer

DNS query

Answer

Normal web browsing

Question 11

An analyst is investigating a Windows host that likely has malware persistence via the registry. Which TWO registry hives are commonly used to store Run keys for user logon persistence? (Select 2)

Accepted Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. The Run keys under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run are standard locations where Windows executes programs automatically at user logon. Malware commonly writes entries to these keys to achieve persistence, making them critical for host-based analysis.

Answer

HKEY_CLASSES_ROOT\*\shell

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\AppInit_DLLs

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Question 12

A security analyst is analyzing a Linux system suspected of being used as a phishing server. Which THREE artifacts should the analyst examine to identify persistence mechanisms? (Select 3)

Accepted Answer

/etc/systemd/system/. Common Linux persistence mechanisms include cron jobs (crontab), systemd services, and startup scripts. Bash history may show commands but is not a persistence mechanism itself.

Answer

/var/log/auth.log

Answer

~/.bash_history

Question 13

A Windows Event Log analysis reveals Event ID 4720 and 4726 occurrences for the same account within a short time. Which TWO actions were performed? (Select 2)

Accepted Answer

User account was deleted. Event ID 4720 indicates account creation, and 4726 indicates account deletion. The rapid creation and deletion may indicate an attempt to avoid detection or create a temporary account.

Answer

User account was locked

Answer

Group policy was updated

Answer

User logged on successfully

Question 14

An analyst is investigating a Windows system for signs of malware persistence. Which registry key is commonly used by malware to run automatically at user logon?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a per-user registry key that specifies programs to run automatically when the user logs on. Malware commonly uses this key for persistence because it executes in the user's context without requiring administrative privileges. This makes it a primary target for autostart persistence.

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

Question 15

During incident response on a Linux server, an analyst runs 'ss -tlnp' and sees an SSH service listening on a non-standard high port. Which step should the analyst take next to investigate potential unauthorized access?

Accepted Answer

Examine /var/log/auth.log for successful logins.. The correct next step is to examine /var/log/auth.log because it records authentication events, including successful SSH logins. Since the SSH service is listening on a non-standard high port, an attacker may have modified the SSH configuration to evade detection and then logged in. Reviewing auth.log will reveal if any unauthorized successful logins occurred, along with source IPs, usernames, and timestamps, which are critical for determining the scope of the incident. This directly addresses the potential unauthorized access indicated by the unusual listening port.

Answer

Review the bash history of root user.

Answer

Check /etc/crontab for malicious scheduled tasks.

Answer

Run 'ps aux' to list all processes.