200-201 Host-Based Analysis Practice Test 5 — 15 Questions

Question 1

An analyst is analyzing a suspicious executable file. Using the 'file' command, it returns 'data' instead of 'PE32 executable'. What is the most likely reason?

Accepted Answer

The file has been packed or encrypted to hide its true nature.. The 'data' result indicates the file's magic bytes do not match known executables, suggesting it might be packed or obfuscated.

Answer

The system is missing the file command database.

Answer

The file is a legitimate PE file with a different extension.

Answer

The file is actually a script written in Python.

Question 2

A forensic analyst uses Volatility on a memory dump and runs the 'malfind' plugin. The output shows a process with a VAD region that has PAGE_EXECUTE_READWRITE protection and contains the pattern 'MZ'. What does this indicate?

Accepted Answer

The process has been infected with code injection, likely a PE executable mapped in memory.. PAGE_EXECUTE_READWRITE protection combined with 'MZ' header suggests code injection, where a malicious executable has been written into the process memory.

Answer

The process is using a packed executable that was unpacked in memory.

Answer

The process has a heap spray attack, but not necessarily injected code.

Answer

The process is a legitimate browser with dynamic code.

Question 3

Which Windows Event ID is recorded when a user account is created, indicating potential unauthorized account creation?

Accepted Answer

4720. Windows Security Event ID 4720 is logged when a user account is created. It is a key indicator for detecting unauthorized account creation, which attackers use for persistence and privilege escalation. This directly matches the question.

Answer

4726

Answer

4648

Answer

4624

Question 4

Which Windows Prefetch file extension indicates that a program has been executed on the system?

Accepted Answer

.pf. Prefetch files with the .pf extension are created by Windows when a program is executed, storing metadata about the executable's loading and execution. The presence of a .pf file in C:\Windows\Prefetch is a strong indicator that the program ran on the system. This makes .pf the correct extension for indicating program execution.

Answer

.evtx

Answer

.tmp

Answer

.log

Question 5

An analyst finds an unknown scheduled task on a Windows system that runs a PowerShell script at system startup. Which tool is best for examining the task's trigger and actions?

Accepted Answer

Task Scheduler. Task Scheduler is the native Windows tool that displays scheduled tasks along with their triggers (e.g., 'At system startup') and actions (e.g., running a PowerShell script). It provides a GUI and command-line interface (schtasks) to inspect, modify, or disable suspicious tasks, making it the best fit for examining the task's configuration.

Answer

Services.msc

Answer

Event Viewer

Answer

Registry Editor

Question 6

Which Linux log file is most appropriate for reviewing failed SSH login attempts?

Accepted Answer

/var/log/auth.log. /var/log/auth.log is the standard Linux log file that records authentication events, including successful and failed SSH login attempts, sudo usage, and PAM-related messages. On Debian/Ubuntu systems, sshd logs authentication failures here via the authpriv facility. This makes it the most appropriate file for reviewing failed SSH logins.

Answer

/var/log/messages

Answer

/var/log/kern.log

Answer

/var/log/syslog

Question 7

An analyst is examining a PE file and notices that the 'TimeDateStamp' in the optional header is 0x00000000. What does this suggest?

Accepted Answer

The timestamp has been deliberately erased or not set, possibly to avoid forensic analysis.. A timestamp of zero often indicates the linker did not set it, which is common for malware or files compiled with certain tools that omit the timestamp.

Answer

The file is digitally signed.

Answer

The file was compiled on January 1, 1970 (Unix epoch).

Answer

The file is a DLL rather than an executable.

Question 8

An analyst is investigating a Linux system for persistence mechanisms. Which TWO of the following are common locations for cron-based persistence? (Select TWO)

Accepted Answer

/var/spool/cron/crontabs/. Option A (/var/spool/cron/crontabs/) is correct because this is the directory where per-user crontab files are stored on Debian/Ubuntu-style systems, and attackers commonly drop a crontab entry here to run a payload under a specific user account at scheduled intervals. Option C (/etc/crontab) is correct because it is the system-wide crontab file that supports the extra user field and is a frequent target for persistence, since a malicious line added here executes with the specified user's privileges on a recurring schedule. Option B (/etc/init.d/) is not cron-based; it holds SysV init scripts for service startup, not scheduled jobs. Option D (/var/log/cron) is a log file recording cron activity, useful for detection but not a persistence location. Option E (/etc/systemd/system/) is for systemd unit files, a separate persistence mechanism from cron.

Answer

/etc/init.d/

Answer

/var/log/cron

Answer

/etc/systemd/system/

Question 9

During memory analysis using Volatility, an analyst wants to identify processes with suspicious network connections and potentially injected code. Which THREE plugins should the analyst use? (Select THREE)

Accepted Answer

pstree. Option B, pstree, is correct because it displays the process list as a parent-child tree, which helps the analyst spot anomalous process relationships and suspicious processes that may be tied to injected code or malicious network activity. Option D, malfind, is correct because it scans process memory for signs of code injection such as MZ/PE headers in non-image memory regions with PAGE_EXECUTE_READWRITE permissions, directly addressing the injected-code requirement. Option E, netscan, is correct because it enumerates network artifacts (TCP connections, listening sockets, and UDP endpoints) from memory, allowing identification of processes with suspicious network connections. Option A, hashdump, is not appropriate here because it extracts password hashes from the SAM database rather than analyzing processes or network connections. Option C, hivelist, is not appropriate because it only lists registry hives loaded in memory and does not reveal process, injection, or network details.

Answer

hashdump

Answer

hivelist

Question 10

A security analyst is investigating a Windows host suspected of malware infection. Which tool would allow the analyst to view parent-child relationships of running processes and inspect command line arguments?

Accepted Answer

Process Explorer. Process Explorer, part of Microsoft Sysinternals, provides a hierarchical view of running processes, showing parent-child relationships and allowing inspection of command-line arguments via the process properties. It also offers advanced features like VirusTotal integration and handle/ DLL views, making it the ideal tool for this investigation.

Answer

Task Manager

Answer

tasklist command

Answer

Resource Monitor

Question 11

During a host-based analysis, a Windows system is found to have a suspicious service that starts automatically. Which command-line tool can be used to query the status and configuration of services, particularly to identify non-standard service names or paths?

Accepted Answer

sc query. The 'sc query' command queries the Service Control Manager for service status and configuration, and with 'sc qc' it reveals the binary path, start type, and service account — exactly what's needed to spot non-standard service names or paths. It works from the command line, making it suitable for scripted forensic triage. Analysts use 'sc query state= all' to enumerate all services and 'sc qc <name>' to inspect suspicious ones.

Answer

services.msc

Answer

tasklist /svc

Answer

net start

Question 12

A Windows event log review shows Event ID 4625 multiple times from a single source IP. What does this event indicate, and which log contains it?

Accepted Answer

Failed logon; Security log. Event ID 4625 is a failed logon attempt, recorded in the Security log.

Answer

Successful logon; System log

Answer

Service start; System log

Answer

Account creation; Application log

Question 13

In Linux forensics, which file would an analyst check to see command history of a user, potentially revealing malicious commands executed?

Accepted Answer

/home/user/.bash_history. Bash history is stored in ~/.bash_history for each user.

Answer

/etc/passwd

Answer

/proc/net/tcp

Answer

/var/log/auth.log

Question 14

An analyst uses Volatility on a memory dump and runs the 'pstree' command. What specific information does this provide compared to 'pslist'?

Accepted Answer

It displays the process tree hierarchy.. The Volatility 'pstree' plugin displays the process tree hierarchy, showing parent-child relationships between processes. Unlike 'pslist', which lists processes in a flat table ordered by creation time, 'pstree' visually indents child processes under their parents. This helps analysts identify suspicious process lineage, such as a web server spawning a shell.

Answer

It shows only hidden processes.

Answer

It extracts command line arguments.

Answer

It lists loaded kernel modules.

Question 15

When analyzing a suspicious PE file, the analyst calculates the file's entropy and finds it to be 7.8. What does a high entropy value typically indicate, and why is it relevant to malware analysis?

Accepted Answer

The file is likely packed or encrypted to evade signature-based detection.. A high entropy value (close to 8.0) indicates that the data within the file is highly random, which is a strong sign of packing or encryption. Malware authors use packers to obfuscate the original executable code, making it harder for signature-based detection engines to identify known malicious patterns. In malware analysis, entropy is a quick heuristic to flag files that may be hiding their true content.

Answer

The file contains no executable code.

Answer

The file is likely a legitimate application with high compression.

Answer

The file's imports are all standard Windows DLLs.