200-201 Host-Based Analysis Practice Test 6 — 15 Questions

Question 1

During a host-based analysis of a Windows system, an analyst finds a suspicious executable that runs every time the system boots. Which registry key is most commonly used for this type of persistence?

Accepted Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. The Run registry key under HKLM and HKCU is a common location for programs to automatically start at boot. Malicious software often adds entries here to achieve persistence.

Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\AppInit_DLLs

Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Image File Execution Options

Question 2

An analyst is investigating a Linux system and wants to view the current network connections. Which command is most appropriate to list listening TCP ports along with the associated processes?

Accepted Answer

ss -tlnp. The 'ss' command with options -t (TCP), -l (listening), -n (numeric), -p (process) shows listening TCP ports and the corresponding processes.

Answer

netstat -anp

Answer

cat /proc/net/tcp

Answer

lsof -i TCP

Question 3

A security analyst is analyzing a memory dump from a compromised Windows system using Volatility. Which command would best reveal hidden or injected code within a process?

Accepted Answer

vol.py malfind. The 'malfind' command scans for anomalous memory regions that often indicate code injection, such as executable pages not backed by a file on disk.

Answer

vol.py netscan

Answer

vol.py pslist

Answer

vol.py dlllist

Question 4

An analyst is reviewing Windows Event Logs and finds Event ID 4648. What does this event typically indicate?

Accepted Answer

A logon using explicit credentials. Event ID 4648 indicates that a logon was attempted using explicit credentials, meaning a user supplied credentials to run a program or access a resource.

Answer

A failed logon attempt

Answer

An account creation event

Answer

A successful logon event

Question 5

During a host-based analysis, an analyst discovers a suspicious service on a Windows machine. Which tool or command can be used to query the service configuration?

Accepted Answer

sc query. The 'sc' command-line tool (Service Control) can query and modify services. 'sc query' shows the status, and 'sc qc' shows the configuration.

Answer

reg query

Answer

schtasks

Answer

tasklist

Question 6

An analyst wants to determine if a specific executable has been run on a Windows system. Which artifact provides evidence of prior execution?

Accepted Answer

Prefetch files. Prefetch files (.pf) are created by Windows when an executable runs, storing execution details such as the first eight file paths referenced and the last run time. Analyzing Prefetch files allows an analyst to determine if a specific executable has been executed, even if the executable itself has been deleted. This makes Prefetch the most direct artifact for evidence of prior execution.

Answer

Registry Run keys

Answer

Task Scheduler logs

Answer

Windows Event Logs

Question 7

An analyst is examining a suspicious PE file. The file's entropy is very high (close to 8.0) and the import table is almost empty. What does this indicate?

Accepted Answer

The file is likely packed or obfuscated. High entropy and a sparse import table strongly suggest the file is packed or encrypted. Packers often compress the original code, raising entropy and obfuscating imports.

Answer

The file is a DLL file

Answer

The file is a standard Windows executable with many imports

Answer

The file has been digitally signed

Question 8

In a Linux system, an analyst wants to check for unauthorized cron jobs. Which of the following is a common location for user-specific cron jobs?

Accepted Answer

/var/spool/cron/crontabs/. User-specific cron jobs are stored in /var/spool/cron/crontabs/ (or /var/spool/cron/ on some distributions), named after the user.

Answer

/var/log/cron

Answer

/etc/cron.d/

Answer

/etc/crontab

Question 9

An analyst runs Volatility's pstree plugin on a memory dump. The output shows that a process 'svchost.exe' is the child of 'explorer.exe'. What is suspicious about this?

Accepted Answer

svchost.exe should be a child of services.exe, not explorer.exe. Option C is correct because in a normal Windows system, svchost.exe is a service host process that should always be a child of services.exe, which is the Service Control Manager (SCM). When svchost.exe appears as a child of explorer.exe, it indicates that a malicious process or attacker has spawned a fake svchost.exe from explorer.exe to evade detection, as legitimate svchost.exe instances are never launched from the Windows shell.

Answer

explorer.exe should not have any child processes

Answer

Nothing, svchost.exe can be a child of any process

Answer

The pstree output is unreliable

Question 10

Which Windows Event ID corresponds to a successful user logon?

Accepted Answer

4624. Event ID 4624 is logged when a user successfully logs on to a system.

Answer

4648

Answer

4776

Answer

4625

Question 11

An analyst is reviewing a memory dump and uses Volatility's cmdline plugin to view process command lines. One process shows command line arguments that include a long base64-encoded string. What should the analyst suspect?

Accepted Answer

The process may be running obfuscated malicious code. The presence of a long base64-encoded string in a process command line is a strong indicator of obfuscation, commonly used by malware to hide payloads or configuration data from static analysis. Base64 encoding is not encryption; it is a simple encoding scheme that can be easily decoded, but it obscures the string's content from casual inspection. Volatility's cmdline plugin reveals this artifact, and an analyst should suspect that the process is executing obfuscated malicious code, as attackers frequently use this technique to evade signature-based detection.

Answer

The process is benign and the string is a normal parameter

Answer

The string is a hash for integrity verification

Answer

The process is using encryption

Question 12

An analyst is examining a Linux server and notices an unusual systemd service that starts automatically. Which command would be used to disable this service?

Accepted Answer

systemctl disable servicename. The 'systemctl disable' command prevents a service from starting automatically at boot.

Answer

systemctl stop servicename

Answer

systemctl remove servicename

Answer

systemctl mask servicename

Question 13

An analyst is investigating a Windows system for signs of malware persistence. Which TWO registry locations are commonly used by malware to achieve automatic startup? (Choose two.)

Accepted Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. A is correct because the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run registry key is a standard autostart location that launches programs when the current user logs in. Malware frequently writes a value here to achieve persistence without requiring administrative privileges, as it affects only the current user's session.

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\AppInit_DLLs

Question 14

An analyst is analyzing a Linux system that may have been compromised. Which THREE artifacts would provide evidence of attacker activity? (Choose three.)

Accepted Answer

/var/spool/cron/crontabs/. Bash history contains commands executed by users, auth.log records login attempts, and cron jobs can be used for persistence. /etc/passwd shows user accounts but not activity.

Answer

/proc/cpuinfo

Answer

/etc/passwd

Question 15

During memory analysis using Volatility, an analyst wants to identify processes that may be hiding. Which TWO plugins are most useful for detecting hidden or injected code? (Choose two.)

Accepted Answer

malfind. psxview compares process listings from different sources to find discrepancies, while malfind detects injected code. pslist lists normally, and cmdline shows command lines.

Answer

pslist

Answer

dlllist

Answer

cmdline