200-201 Host-Based Analysis Practice Test 6 — 15 Questions

Question 1

A Linux analyst wants to identify all listening TCP ports on a system. Which command is most appropriate?

Accepted Answer

ss -tlnp. ss -tlnp shows listening TCP sockets with process info.

Answer

netstat -an

Answer

lsof -i

Answer

ps aux

Question 2

In Windows, prefetch files (C:\Windows\Prefetch\*.pf) are used by the system to speed up application loading. How can an analyst leverage prefetch files during host-based analysis?

Accepted Answer

They provide evidence of file execution, including frequency and timestamps.. Prefetch files in Windows record metadata about application launches, including the executable path, run count, and last run timestamp. During host-based analysis, an analyst can examine these .pf files to determine which executables have been executed, how often, and when, providing crucial evidence of file execution activity.

Answer

They store network connection logs.

Answer

They store registry keys modified by the application.

Answer

They contain the contents of the running process memory.

Question 3

An analyst examining a Linux server notices an unusual cron job in /etc/crontab that runs a script every 5 minutes. Which of the following describes the best approach to determine if this cron job is malicious?

Accepted Answer

Check the script's content, owner, and compare its hash with known threats.. Inspecting the script content and correlating with known persistence techniques helps assess maliciousness.

Answer

Ignore it because cron jobs are always legitimate.

Answer

Delete the cron job immediately to stop potential malicious activity.

Answer

Run the script in a sandbox to see what it does.

Question 4

A Windows system's security log shows Event ID 4720 followed by 4726 for the same username within minutes. What does this sequence indicate?

Accepted Answer

An account was created and then deleted, possibly for short-term unauthorized access.. Event ID 4720 indicates a user account was created, and 4726 indicates it was deleted. The short interval suggests the account was created for temporary access, possibly malicious, and then removed to cover tracks.

Answer

A user changed their password.

Answer

The account was successfully logged on.

Answer

A group membership was changed.

Question 5

When performing file analysis, which method is most reliable for determining the actual file type regardless of its extension?

Accepted Answer

Examining the file's magic bytes. Magic bytes (or file signatures) are unique byte sequences at the beginning of a file that identify its format regardless of the file extension. This method is reliable because it examines the actual binary content, such as the 'PK' header for ZIP files or '‰PNG' for PNG images, rather than relying on user-assigned metadata that can be easily changed.

Answer

Opening the file in a text editor

Answer

Checking the file extension

Answer

Checking the file size

Question 6

An analyst is investigating a Windows host for malware persistence. Which TWO registry locations are commonly abused for persistence by modifying the 'Run' key? (Select TWO)

Accepted Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\Run. Both HKLM and HKCU Run keys are commonly used for persistence.

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

Answer

HKLM\System\CurrentControlSet\Services

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

Question 7

A Linux server has been compromised. The analyst checks for persistence mechanisms. Which THREE of the following are common Linux persistence techniques that should be examined? (Select THREE)

Accepted Answer

Creating a systemd service unit. Creating a systemd service unit is a common Linux persistence technique because systemd is the default init system for most modern Linux distributions. An attacker can place a malicious service file (e.g., /etc/systemd/system/evil.service) that automatically starts the malware at boot or after a crash, ensuring continued access even after a reboot.

Answer

Changing the system timezone

Answer

Modifying the /etc/hosts file

Question 8

An analyst is reviewing Windows Event Logs and sees Event ID 4625. What does this event indicate?

Accepted Answer

An account logon failed. Event ID 4625 in the Security log indicates a failed logon attempt. This is often used to detect brute-force attacks or unauthorized access attempts.

Answer

Credential validation was attempted

Answer

An account was created

Answer

An account was successfully logged on

Question 9

An analyst is investigating a Windows system where a suspicious executable is running. Using Process Explorer, the analyst observes that the process 'svchost.exe' has a parent process of 'cmd.exe'. What is the significance of this parent-child relationship?

Accepted Answer

It indicates that svchost.exe is likely malicious, as it should be spawned by services.exe. Legitimate svchost.exe processes are spawned by services.exe, not cmd.exe. A parent of cmd.exe indicates that svchost.exe was launched manually, which is abnormal and suggests malicious activity.

Answer

It shows that svchost.exe is a critical system process and is safe

Answer

It suggests that svchost.exe is a child of explorer.exe, which is normal

Answer

It is normal behavior; svchost.exe often has cmd.exe as parent

Question 10

During forensic analysis of a Windows host, an analyst finds a file in C:\Windows\Prefetch with the name 'MALWARE.EXE-3F2A1B0C.pf'. Which type of information can be extracted from this prefetch file to assist the investigation?

Accepted Answer

The number of times the executable has been run and the last execution timestamp. Windows Prefetch files (.pf) store execution metadata for applications, including the run count and the last time the executable was executed (plus up to the last eight run timestamps on some Windows versions). This makes them a primary artifact for establishing whether and when malware ran on a host.

Answer

The file's SHA256 hash and digital signature status

Answer

The registry keys modified by the executable during execution

Answer

The command-line arguments used when the executable was launched

Question 11

An analyst is examining a Linux system for persistence mechanisms. Which of the following files should be reviewed to detect cron-based persistence?

Accepted Answer

/var/spool/cron/crontabs. The correct answer is /var/spool/cron/crontabs because this directory stores user-specific cron jobs on Debian-based Linux systems. Attackers often add malicious entries here to maintain persistence by scheduling recurring tasks. Reviewing this directory reveals unauthorized scheduled jobs that could execute malware or reverse shells at regular intervals.

Answer

/var/log/auth.log

Answer

/etc/passwd

Answer

/home/user/.bash_history

Question 12

A security analyst is analyzing a suspicious PE file. Using a hex editor, the analyst sees the ASCII string 'MZ' at the beginning. What does this indicate?

Accepted Answer

The file is a Windows Portable Executable. The ASCII string 'MZ' at the beginning of a file is the DOS MZ header signature, which identifies the file as a Windows Portable Executable (PE) or a DOS executable. 'MZ' stands for Mark Zbikowski, the Microsoft engineer who designed the format. This signature is the first two bytes of every PE file and is used by Windows loaders to recognize executable images.

Answer

The file is a plain text file

Answer

The file is a Linux ELF binary

Answer

The file is a PDF document

Question 13

An analyst needs to check for services that were set to start automatically on a Windows host. Which command-line utility can be used to query the state and start type of all services?

Accepted Answer

sc query. The 'sc query' command retrieves information about services, including their state and start type (auto, manual, disabled). It is useful for identifying suspicious services.

Answer

tasklist

Answer

schtasks

Answer

netstat

Question 14

An analyst is investigating a Linux host and runs 'cat /proc/1234/cmdline'. What information does this provide?

Accepted Answer

The command line and arguments used to start the process. The file /proc/1234/cmdline is a pseudo-file exposed by the Linux kernel's procfs for the process with PID 1234. Reading it returns the exact command line and arguments that were passed to execve() when the process was started, with arguments separated by NUL bytes. This is why 'cat' often shows the arguments run together — the NUL separators are not rendered as visible characters.

Answer

The memory map of the process

Answer

The environment variables of the process

Answer

The current working directory of the process

Question 15

An analyst finds a registry modification under 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options'. What is the primary use of this registry key?

Accepted Answer

To set a debugger that runs when the image is executed. The Image File Execution Options (IFEO) registry key is used to specify a debugger that launches when a particular executable is started. Attackers abuse this by setting a 'Debugger' value to a malicious binary, achieving persistence and execution hijacking. Legitimate use includes attaching debuggers to specific processes, but the primary security-relevant function is debugger redirection.

Answer

To configure network firewall rules for the image

Answer

To change the file extension association for the image

Answer

To log all execution of the image to the Event Log