200-201 Host-Based Analysis Practice Test 7 — 15 Questions

Question 1

A forensic analyst is examining a suspicious file. The file has a high entropy score (close to 8.0) and the PE section names are obfuscated. Which tool or technique would best help determine if the file is packed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Analyze the PE sections and calculate entropy to detect packing. High entropy (close to 8.0) indicates the file's byte distribution is nearly random, which is characteristic of compressed or encrypted data — exactly what packers produce. Combined with obfuscated PE section names (e.g., UPX0, .aspack, or random strings), analyzing PE section headers and computing per-section entropy is the definitive method to confirm packing. Tools like PEiD, Detect It Easy, or pefile in Python automate this by flagging sections with entropy >7.0 and non-standard names.

Answer

Use the 'strings' command to extract readable strings

Answer

Check the file's digital signature

Answer

Run the 'file' command in Linux

Question 2

An analyst is examining a Linux system for signs of an attacker establishing persistence. Which TWO of the following locations should the analyst check? (Choose two.)

Accepted Answer

/etc/systemd/system/. Option C, /etc/systemd/system/, is correct because attackers commonly drop malicious .service unit files there to establish persistence via systemd, causing their payload to execute at boot or on a trigger. Option D, /etc/crontab, is correct because scheduled tasks in this file (and related cron directories) are a classic persistence mechanism, allowing an attacker to re-execute code at defined intervals. Option A, /etc/passwd, is not the best choice here since it stores user account information rather than a direct persistence trigger, though it can be abused to add accounts. Option B, /proc/self/status, is a runtime process status file and does not provide a persistence location. Option E, /home/user/.bash_history, is useful for forensic reconstruction of past commands but is not itself a persistence mechanism.

Answer

/etc/passwd

Answer

/proc/self/status

Answer

/home/user/.bash_history

Question 3

An analyst is investigating a Windows host and observes a suspicious process with PID 1337. Which THREE of the following Volatility commands would provide useful information about this process? (Choose three.)

Accepted Answer

cmdline. The `cmdline` plugin displays the command-line arguments used to start a process, which is critical for identifying malicious or suspicious execution patterns (e.g., obfuscated paths, encoded commands). For PID 1337, this reveals exactly how the process was launched, helping to confirm or refute malicious intent.

Answer

hivelist

Answer

connscan

Question 4

A security analyst is investigating a Windows host and wants to view running processes along with their parent-child relationships and command-line arguments. Which tool is best suited for this task?

Accepted Answer

Process Explorer. Process Explorer provides detailed process information including parent PID and command line, while Task Manager and tasklist show limited details. Volatility is a memory analysis tool, not for live host analysis.

Answer

Volatility

Answer

tasklist

Answer

Task Manager

Question 5

An analyst discovers a suspicious service on a Windows host. Which command can be used to query the status and details of services from the command line?

Accepted Answer

sc query. The 'sc query' command queries the Service Control Manager for the status of a specified service (or all services) directly from the command line, showing state (RUNNING/STOPPED), service type, and exit codes. It is the standard CLI tool for enumerating and inspecting Windows services during host-based forensic analysis. 'sc query type= service state= all' lists every service with its status, making it ideal for spotting suspicious entries.

Answer

services.msc

Answer

net start

Answer

tasklist /svc

Question 6

During an incident response, an analyst checks for persistence mechanisms and finds an entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. What is the most likely purpose of this registry key?

Accepted Answer

It specifies programs to run automatically at user logon.. It specifies programs to run automatically at user logon is correct because the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key is a common autostart location that executes programs when the user logs in. Attackers often use this key for persistence to ensure their malware runs after a reboot or logon.

Answer

It lists recently accessed documents.

Answer

It stores user interface settings for the current user.

Answer

It controls Windows Defender exclusions.

Question 7

An analyst is reviewing Windows Security Event Logs and finds Event ID 4648. What does this event indicate?

Accepted Answer

A logon attempt using explicit credentials was attempted.. Windows Security Event ID 4648 indicates that a logon attempt was made using explicit credentials — that is, a process attempted to log on with credentials different from those of the current user. This is commonly seen when using RunAs or scheduled tasks with stored credentials. It is a key event for detecting lateral movement or credential misuse.

Answer

A service was installed.

Answer

A user account was created.

Answer

A scheduled task was created.

Question 8

An analyst is performing memory forensics on a Windows machine using Volatility. Which command would be most useful to identify hidden or injected code within a process?

Accepted Answer

malfind. The `malfind` plugin in Volatility is specifically designed to detect hidden or injected code in process memory. It scans for memory regions that are both executable and writable (or have no file backing on disk), which are common indicators of code injection techniques like process hollowing or reflective DLL injection. By identifying these suspicious memory pages, `malfind` helps analysts uncover malware that attempts to hide within legitimate processes.

Answer

dlllist

Answer

netscan

Answer

pslist

Question 9

During a forensic examination of a Linux system, an analyst wants to check for persistence mechanisms. Which file or directory should be examined to find user-specific cron jobs that may have been added by an attacker?

Accepted Answer

/var/spool/cron/crontabs/. User-specific cron jobs are stored in /var/spool/cron/crontabs/ (on Debian-based systems) or /var/spool/cron/ (on Red Hat-based systems). Each user has a file named after their username containing their cron jobs. Attackers often add entries here for persistence. The other locations are for system-wide cron jobs.

Answer

/etc/cron.hourly/

Answer

/etc/cron.d/

Answer

/etc/crontab

Question 10

An analyst is analyzing a suspicious PE file. The file's entropy is high (close to 8.0), and the section names appear random. What does this likely indicate?

Accepted Answer

The file is likely packed or encrypted.. High entropy close to 8.0 indicates that the data is highly random, which is characteristic of packed or encrypted content. Malware authors use packers and crypters to compress and encrypt the executable, making static analysis difficult. Random section names further suggest that the PE file has been modified by a packer, as legitimate compilers typically produce meaningful section names like .text and .data.

Answer

The file is a script compiled to an executable.

Answer

The file is a legitimate Windows system file.

Answer

The file has been digitally signed.

Question 11

An analyst uses Volatility's pstree plugin on a memory dump. The output shows that process 'winlogon.exe' has a child process 'cmd.exe' that is not typical. What is the most likely explanation?

Accepted Answer

An attacker may have used Sticky Keys or similar persistence.. In a normal Windows session, winlogon.exe spawns userinit.exe (which then launches explorer.exe) — it should never spawn cmd.exe. A cmd.exe child of winlogon.exe is a classic indicator of the Sticky Keys (sethc.exe) or Utilman accessibility-feature backdoor, where an attacker replaces the binary with cmd.exe so that pressing Shift five times at the logon screen yields a SYSTEM-level shell. This persistence technique survives reboots and is frequently observed in memory forensics via pstree output.

Answer

A user is running a command prompt remotely.

Answer

A scheduled task is running.

Answer

The system is performing a normal update.

Question 12

An analyst is reviewing Windows Event Logs and sees multiple Event ID 4625 entries from a single IP address. What does this indicate?

Accepted Answer

A brute-force password guessing attack.. Event ID 4625 in Windows Security logs indicates a failed logon attempt. Multiple such events from a single IP address suggest a brute-force password guessing attack, where an attacker repeatedly tries different passwords. This pattern is a classic indicator of compromise.

Answer

A user account was locked out.

Answer

A service account password expired.

Answer

Successful remote logins from that IP.

Question 13

An incident responder is analyzing a Windows machine for evidence of malware persistence. Which TWO registry keys are commonly abused to achieve automatic execution at user logon?

Accepted Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\Run. Options A and D are correct because HKLM\Software\Microsoft\Windows\CurrentVersion\Run and HKCU\Software\Microsoft\Windows\CurrentVersion\Run are the canonical Run keys that Windows automatically processes at user logon, launching any listed program for all users (HKLM) or the specific user (HKCU), which is why malware commonly writes here for persistence. Option C (RunOnce) also triggers at logon but is designed for one-time execution and the value is deleted after it runs, so it is not the standard persistent automatic-execution key the question targets. Option B (AppInit_DLLs) is a DLL-injection mechanism loaded into processes using User32.dll, not a logon-triggered program launcher. Option E (Image File Execution Options) is abused for debugger hijacking or executable redirection, not for automatic execution at logon.

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs

Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

Question 14

An analyst is using Volatility to analyze a memory dump. Which TWO plugins are most effective for detecting code injection?

Accepted Answer

ldrmodules. Option A, ldrmodules, is correct because it compares the three DLL/module lists maintained in the PEB (InLoad, InInit, InMem) and flags modules that appear in memory but are absent from the loader list, a classic sign of injected or unlinked DLLs. Option C, malfind, is correct because it scans process memory for pages with MZ/PE headers that are not backed by a file on disk and have suspicious protection flags such as PAGE_EXECUTE_READWRITE, which is the standard indicator of injected code. The unmarked options do not belong: pslist merely walks the doubly linked process list to enumerate running processes, pstree shows parent-child process relationships, and netscan lists network connections and sockets; none of these inspect module lists or memory pages for injected code.

Answer

pslist

Answer

pstree

Answer

netscan

Question 15

An analyst is investigating a Linux system and wants to view the current network connections. Which command is most appropriate to list listening TCP ports along with the associated processes?

Accepted Answer

ss -tlnp. 'ss -tlnp' lists TCP (-t) listening (-l) sockets with numeric ports (-n) and the owning process (-p), which is exactly what the analyst needs. The ss utility reads kernel netlink sockets directly, making it faster and more accurate than netstat on modern Linux systems.

Answer

netstat -anp

Answer

cat /proc/net/tcp

Answer

lsof -i TCP