200-201 Host-Based Analysis Practice Test 4 — 15 Questions

Question 1

An analyst is investigating a Windows host for signs of malware persistence. Which registry key would the analyst check for programs that run automatically when any user logs in?

Accepted Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. The Run registry key under HKEY_LOCAL_MACHINE specifies programs that run for all users at logon, while HKEY_CURRENT_USER is per-user. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run is the most common location for malware persistence.

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

Answer

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services

Question 2

During an incident response, a Linux system shows unusual outbound network connections from a process named 'httpd'. The analyst uses 'ss -tlnp' to examine listening sockets. Which column would most likely indicate if the process is malicious?

Accepted Answer

Process. The 'Process' column in 'ss -tlnp' shows the PID and process name. If the process name is misrepresented or the PID does not match a legitimate httpd, it indicates malicious activity.

Answer

Local Address:Port

Answer

State

Answer

Peer Address:Port

Question 3

A security analyst is analyzing a memory dump using Volatility. The command 'volatility -f mem.dump malfind' returns several results with VAD tags 'VadS' and 'Vadl'. What does this indicate?

Accepted Answer

The process likely has injected code, as these VAD tags indicate executable writable memory. Malfind detects injected code by scanning for VADs with specific protection flags. 'VadS' indicates a VAD with PAGE_EXECUTE_READWRITE protection, common for shellcode injection. 'Vadl' is for large pages. The presence of these tags strongly suggests code injection.

Answer

The process has no suspicious memory regions

Answer

The process has legitimate DLLs loaded in memory

Answer

The process is a kernel-mode driver

Question 4

An analyst is reviewing Windows Event Logs and sees Event ID 4625. What does this event indicate?

Accepted Answer

An account logon failed. Event ID 4625 in the Security log indicates a failed logon attempt. This is often used to detect brute-force attacks or unauthorized access attempts.

Answer

Credential validation was attempted

Answer

An account was created

Answer

An account was successfully logged on

Question 5

An analyst is investigating a Windows system where a suspicious executable is running. Using Process Explorer, the analyst observes that the process 'svchost.exe' has a parent process of 'cmd.exe'. What is the significance of this parent-child relationship?

Accepted Answer

It indicates that svchost.exe is likely malicious, as it should be spawned by services.exe. Legitimate svchost.exe processes are spawned by services.exe, not cmd.exe. A parent of cmd.exe indicates that svchost.exe was launched manually, which is abnormal and suggests malicious activity.

Answer

It shows that svchost.exe is a critical system process and is safe

Answer

It suggests that svchost.exe is a child of explorer.exe, which is normal

Answer

It is normal behavior; svchost.exe often has cmd.exe as parent

Question 6

During forensic analysis of a Windows host, an analyst finds a file in C:\Windows\Prefetch with the name 'MALWARE.EXE-3F2A1B0C.pf'. Which type of information can be extracted from this prefetch file to assist the investigation?

Accepted Answer

The number of times the executable has been run and the last execution timestamp. Prefetch files (.pf) contain the last run time, run count, and paths of files loaded by the executable. This helps determine how many times the malware was executed and when.

Answer

The file's SHA256 hash and digital signature status

Answer

The registry keys modified by the executable during execution

Answer

The command-line arguments used when the executable was launched

Question 7

An analyst is examining a Linux system for persistence mechanisms. Which of the following files should be reviewed to detect cron-based persistence?

Accepted Answer

/var/spool/cron/crontabs. Cron jobs can be set in /etc/crontab, /etc/cron.d/, and user-specific crontabs in /var/spool/cron/. /var/spool/cron/crontabs contains per-user crontabs.

Answer

/var/log/auth.log

Answer

/etc/passwd

Answer

/home/user/.bash_history

Question 8

A security analyst is analyzing a suspicious PE file. Using a hex editor, the analyst sees the ASCII string 'MZ' at the beginning. What does this indicate?

Accepted Answer

The file is a Windows Portable Executable. The 'MZ' magic bytes (0x4D 0x5A) are the signature of a Portable Executable (PE) file, indicating it is a Windows executable. This is the first step in file identification.

Answer

The file is a plain text file

Answer

The file is a Linux ELF binary

Answer

The file is a PDF document

Question 9

An analyst is using Volatility's 'pslist' and 'pstree' commands on a memory dump. The output shows a process named 'lsass.exe' with a PID of 1024. However, the usual PID for lsass.exe on this system is 512. What does this discrepancy likely indicate?

Accepted Answer

It indicates a possible process hollowing or masquerading attack. The 'lsass.exe' process (Local Security Authority Subsystem Service) is a critical Windows system process responsible for enforcing security policies and handling authentication. Under normal conditions, lsass.exe runs as a child of 'winlogon.exe' or 'services.exe' with a consistent PID (often 512 or 528) across boots on a given system. A PID of 1024, especially when the known baseline is 512, strongly suggests that a malicious actor has spawned a fake 'lsass.exe' process via process hollowing (replacing the legitimate process's memory with malicious code) or masquerading (naming a malicious binary to mimic the legitimate one) to evade detection.

Answer

It shows that the system has multiple instances of lsass running

Answer

It is normal; the PID can vary between system boots

Answer

It suggests the process is a legitimate child of services.exe

Question 10

An analyst needs to check for services that were set to start automatically on a Windows host. Which command-line utility can be used to query the state and start type of all services?

Accepted Answer

sc query. The 'sc query' command retrieves information about services, including their state and start type (auto, manual, disabled). It is useful for identifying suspicious services.

Answer

tasklist

Answer

schtasks

Answer

netstat

Question 11

An analyst is investigating a Linux host and runs 'cat /proc/1234/cmdline'. What information does this provide?

Accepted Answer

The command line and arguments used to start the process. The /proc/[pid]/cmdline file contains the full command line used to start the process, including arguments. This helps verify if a process was launched with suspicious parameters.

Answer

The memory map of the process

Answer

The environment variables of the process

Answer

The current working directory of the process

Question 12

An analyst finds a registry modification under 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options'. What is the primary use of this registry key?

Accepted Answer

To set a debugger that runs when the image is executed. Image File Execution Options (IFEO) allow setting debuggers for executables. Malware can abuse this for persistence or to inject code by setting a debugger that launches the malware when the legitimate executable is run.

Answer

To configure network firewall rules for the image

Answer

To change the file extension association for the image

Answer

To log all execution of the image to the Event Log

Question 13

A forensic analyst is examining a suspicious file. The file has a high entropy score (close to 8.0) and the PE section names are obfuscated. Which tool or technique would best help determine if the file is packed?

Accepted Answer

Analyze the PE sections and calculate entropy to detect packing. High entropy suggests compressed or encrypted data, common in packed executables. Tools like PEiD or manual analysis using 'strings' and entropy calculation can confirm packing. Hash comparison with VirusTotal can also help.

Answer

Use the 'strings' command to extract readable strings

Answer

Check the file's digital signature

Answer

Run the 'file' command in Linux

Question 14

An analyst is examining a Linux system for signs of an attacker establishing persistence. Which TWO of the following locations should the analyst check? (Choose two.)

Accepted Answer

/etc/systemd/system/. Common persistence mechanisms on Linux include cron jobs and systemd services. Bash history only records commands, not persistence. /proc is a virtual filesystem. /etc/passwd lists users but doesn't directly show persistence.

Answer

/etc/passwd

Answer

/proc/self/status

Answer

/home/user/.bash_history

Question 15

An analyst is investigating a Windows host for signs of malware persistence. Which registry key would the analyst check for programs that run automatically when any user logs in?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

cmdline. The `cmdline` plugin displays the command-line arguments used to start a process, which is critical for identifying malicious or suspicious execution patterns (e.g., obfuscated paths, encoded commands). For PID 1337, this reveals exactly how the process was launched, helping to confirm or refute malicious intent.

Answer

hivelist

Answer

connscan