200-201 Host-Based Analysis Practice Test 5 — 15 Questions

Question 1

A security analyst is investigating a Windows host and wants to view running processes along with their parent-child relationships and command-line arguments. Which tool is best suited for this task?

Accepted Answer

Process Explorer. Process Explorer provides detailed process information including parent PID and command line, while Task Manager and tasklist show limited details. Volatility is a memory analysis tool, not for live host analysis.

Answer

Volatility

Answer

tasklist

Answer

Task Manager

Question 2

An analyst discovers a suspicious service on a Windows host. Which command can be used to query the status and details of services from the command line?

Accepted Answer

sc query. sc query displays service status and configuration. services.msc is GUI-based, tasklist shows processes, and net start lists running services but with less detail.

Answer

services.msc

Answer

net start

Answer

tasklist /svc

Question 3

During an incident response, an analyst checks for persistence mechanisms and finds an entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. What is the most likely purpose of this registry key?

Accepted Answer

It specifies programs to run automatically at user logon.. The Run key in HKCU or HKLM causes programs to execute automatically when a user logs in. It is commonly used for legitimate software but also for malware persistence.

Answer

It lists recently accessed documents.

Answer

It stores user interface settings for the current user.

Answer

It controls Windows Defender exclusions.

Question 4

An analyst is reviewing Windows Security Event Logs and finds Event ID 4648. What does this event indicate?

Accepted Answer

A logon attempt using explicit credentials was attempted.. Event ID 4648 indicates explicit credentials were used to log on, such as running a program as a different user or using secondary logon. It is distinct from interactive logon (4624) or failed logon (4625).

Answer

A service was installed.

Answer

A user account was created.

Answer

A scheduled task was created.

Question 5

An analyst investigating a Linux host notices an unusual process running as root. Which command would provide the most detailed process listing including parent PID and CPU usage?

Accepted Answer

top. The question requires a command that provides parent PID (PPID) and CPU usage. While `ps aux` shows CPU usage, it does not include PPID. Among the options, `top` is the only command that can be configured to display PPID (by adding the PPID column) and shows CPU usage by default. The other options either show network connections (`ss`), open files (`lsof`), or lack PPID (`ps aux`). Therefore, `top` is the most detailed process listing that includes both PPID and CPU usage.

Answer

ss -tlnp

Answer

ps aux

Answer

lsof

Question 6

A Linux system administrator notices unauthorized SSH logins in /var/log/auth.log. Which of the following log entries would indicate a failed SSH login attempt?

Accepted Answer

Failed password for root. In auth.log, failed SSH logins typically contain 'Failed password' messages. Accepted password indicates success, and Invalid user may accompany failed attempts but the key indicator is 'Failed password'.

Answer

Connection closed by authenticating user

Answer

Session opened for user

Answer

Accepted publickey for root

Question 7

An analyst is performing memory forensics on a Windows machine using Volatility. Which command would be most useful to identify hidden or injected code within a process?

Accepted Answer

malfind. malfind identifies suspicious memory regions, such as injected code. pslist lists processes, netscan shows network connections, and dlllist lists loaded DLLs.

Answer

dlllist

Answer

netscan

Answer

pslist

Question 8

During a forensic examination of a Linux system, an analyst wants to check for persistence mechanisms. Which file or directory should be examined to find user-specific cron jobs that may have been added by an attacker?

Accepted Answer

/var/spool/cron/crontabs/. User-specific cron jobs are stored in /var/spool/cron/crontabs/ (or /var/spool/cron/). /etc/crontab is system-wide, /etc/cron.d is system-wide directories, and /etc/cron.hourly are scripts. The user-specific location is under /var/spool/cron/.

Answer

/etc/cron.hourly/

Answer

/etc/cron.d/

Answer

/etc/crontab

Question 9

An analyst is analyzing a suspicious PE file. The file's entropy is high (close to 8.0), and the section names appear random. What does this likely indicate?

Accepted Answer

The file is likely packed or encrypted.. High entropy suggests the file is packed or encrypted. Normal executables have lower entropy. Packed malware uses compression/encryption to obfuscate code.

Answer

The file is a script compiled to an executable.

Answer

The file is a legitimate Windows system file.

Answer

The file has been digitally signed.

Question 10

An analyst uses Volatility's pstree plugin on a memory dump. The output shows that process 'winlogon.exe' has a child process 'cmd.exe' that is not typical. What is the most likely explanation?

Accepted Answer

An attacker may have used Sticky Keys or similar persistence.. winlogon.exe spawning cmd.exe is unusual and may indicate an attacker used Sticky Keys or similar accessibility feature abuse (sethc.exe) to gain a command prompt at the login screen. Normal winlogon does not launch cmd.exe as a child.

Answer

A user is running a command prompt remotely.

Answer

A scheduled task is running.

Answer

The system is performing a normal update.

Question 11

An analyst is reviewing Windows Event Logs and sees multiple Event ID 4625 entries from a single IP address. What does this indicate?

Accepted Answer

A brute-force password guessing attack.. Event ID 4625 is a failed logon attempt. Multiple failures from the same IP suggest a brute-force attack.

Answer

A user account was locked out.

Answer

A service account password expired.

Answer

Successful remote logins from that IP.

Question 12

An analyst discovers an unknown process on a Windows host that has no parent process (PPID 0). What does this likely indicate?

Accepted Answer

The process is likely hidden or injected by malware.. A process with PPID 0 is unusual and may indicate a rootkit or direct kernel manipulation. Normal processes have a parent, except for the System Idle Process (PID 0).

Answer

The process is a child of the System Idle Process.

Answer

The process is a user-initiated task running normally.

Answer

The process is a legitimate system process started at boot.

Question 13

An incident responder is analyzing a Windows machine for evidence of malware persistence. Which TWO registry keys are commonly abused to achieve automatic execution at user logon?

Accepted Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\Run. HKLM\...\Run and HKCU\...\Run are common persistence locations. RunOnce keys also exist but are for one-time execution. AppInit_DLLs is for DLL injection, and Image File Execution Options are for debugging.

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs

Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

Question 14

A security analyst is examining a Linux system suspected of compromise. Which THREE artifacts should be reviewed to identify potential persistence mechanisms?

Accepted Answer

Cron jobs in /etc/crontab and /var/spool/cron/. Cron jobs, systemd services, and bash history are key for persistence detection. SSH keys can also be used. /proc/cpuinfo is hardware info, not persistence.

Answer

Authorized SSH keys in ~/.ssh/authorized_keys

Answer

/proc/cpuinfo

Question 15

An analyst is using Volatility to analyze a memory dump. Which TWO plugins are most effective for detecting code injection?

Accepted Answer

ldrmodules. malfind specifically detects injected code, and ldrmodules (or dlllist with ldrmodules) helps detect hidden/unlinked DLLs that may indicate injection. pslist shows processes, pstree shows tree, and netscan shows connections.

Answer

pslist

Answer

pstree

Answer

netscan