200-201 Host-Based Analysis Practice Test 8 — 15 Questions

Question 1

A security analyst is analyzing a memory dump from a compromised Windows system using Volatility. Which command would best reveal hidden or injected code within a process?

Accepted Answer

vol.py malfind. The vol.py malfind command in Volatility scans process memory for hidden or injected code by looking for memory regions with suspicious characteristics, such as executable permissions and no corresponding file on disk. It is specifically designed to detect code injection and rootkit-like behavior. This makes it the best choice for revealing hidden or injected code within a process.

Answer

vol.py netscan

Answer

vol.py pslist

Answer

vol.py dlllist

Question 2

An analyst is reviewing Windows Event Logs and finds Event ID 4648. What does this event typically indicate?

Accepted Answer

A logon using explicit credentials. Windows Security Event ID 4648 is logged when a process attempts an explicit-credential logon — that is, when a user or service supplies alternate credentials (via runas, New-PSSession -Credential, or similar) rather than using the current session's token. It records the account that requested the logon and the account whose credentials were used.

Answer

A failed logon attempt

Answer

An account creation event

Answer

A successful logon event

Question 3

An analyst wants to determine if a specific executable has been run on a Windows system. Which artifact provides evidence of prior execution?

Accepted Answer

Prefetch files. Prefetch files (.pf) are created by Windows when an executable runs, storing execution details such as the first eight file paths referenced and the last run time. Analyzing Prefetch files allows an analyst to determine if a specific executable has been executed, even if the executable itself has been deleted. This makes Prefetch the most direct artifact for evidence of prior execution.

Answer

Registry Run keys

Answer

Task Scheduler logs

Answer

Windows Event Logs

Question 4

An analyst is examining a suspicious PE file. The file's entropy is very high (close to 8.0) and the import table is almost empty. What does this indicate?

Accepted Answer

The file is likely packed or obfuscated. High entropy close to 8.0 indicates that the file's data is highly random, which is characteristic of packed or encrypted content. An almost empty import table suggests that the file does not statically import many functions, common in packed malware that resolves imports dynamically at runtime. Together, these strongly indicate packing or obfuscation.

Answer

The file is a DLL file

Answer

The file is a standard Windows executable with many imports

Answer

The file has been digitally signed

Question 5

In a Linux system, an analyst wants to check for unauthorized cron jobs. Which of the following is a common location for user-specific cron jobs?

Accepted Answer

/var/spool/cron/crontabs/. User-specific cron jobs are stored in /var/spool/cron/crontabs/ (or /var/spool/cron/ on some distributions), named after the user.

Answer

/var/log/cron

Answer

/etc/cron.d/

Answer

/etc/crontab

Question 6

An analyst runs Volatility's pstree plugin on a memory dump. The output shows that a process 'svchost.exe' is the child of 'explorer.exe'. What is suspicious about this?

Accepted Answer

svchost.exe should be a child of services.exe, not explorer.exe. In a normal Windows system, svchost.exe is a service host process that should always be a child of services.exe, which is the Service Control Manager (SCM). When svchost.exe appears as a child of explorer.exe, it indicates that a malicious process or attacker has spawned a fake svchost.exe from explorer.exe to evade detection, as legitimate svchost.exe instances are never launched from the Windows shell.

Answer

explorer.exe should not have any child processes

Answer

Nothing, svchost.exe can be a child of any process

Answer

The pstree output is unreliable

Question 7

Which Windows Event ID corresponds to a successful user logon?

Accepted Answer

4624. Event ID 4624 is correct because Windows Security auditing logs 4624 for a successful account logon, including the logon type (interactive, network, service, etc.) and the account and workstation involved. It is the canonical event analysts filter on to confirm successful authentication.

Answer

4648

Answer

4776

Answer

4625

Question 8

An analyst is reviewing a memory dump and uses Volatility's cmdline plugin to view process command lines. One process shows command line arguments that include a long base64-encoded string. What should the analyst suspect?

Accepted Answer

The process may be running obfuscated malicious code. The presence of a long base64-encoded string in a process command line is a strong indicator of obfuscation, commonly used by malware to hide payloads or configuration data from static analysis. Base64 encoding is not encryption; it is a simple encoding scheme that can be easily decoded, but it obscures the string's content from casual inspection. Volatility's cmdline plugin reveals this artifact, and an analyst should suspect that the process is executing obfuscated malicious code, as attackers frequently use this technique to evade signature-based detection.

Answer

The process is benign and the string is a normal parameter

Answer

The string is a hash for integrity verification

Answer

The process is using encryption

Question 9

An analyst is examining a Linux server and notices an unusual systemd service that starts automatically. Which command would be used to disable this service?

Accepted Answer

systemctl disable servicename. The 'systemctl disable' command prevents a service from starting automatically at boot.

Answer

systemctl stop servicename

Answer

systemctl remove servicename

Answer

systemctl mask servicename

Question 10

An analyst is investigating a Windows system for signs of malware persistence. Which TWO registry locations are commonly used by malware to achieve automatic startup? (Choose two.)

Accepted Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. A is correct because the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run registry key is a standard autostart location that launches programs when the current user logs in. Malware frequently writes a value here to achieve persistence without requiring administrative privileges, as it affects only the current user's session.

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\AppInit_DLLs

Question 11

An analyst is analyzing a Linux system that may have been compromised. Which THREE artifacts would provide evidence of attacker activity? (Choose three.)

Accepted Answer

/var/spool/cron/crontabs/. Option B, /var/spool/cron/crontabs/, is correct because attackers commonly establish persistence by adding malicious cron jobs here (per-user crontabs on Debian/Ubuntu systems), so unexpected entries provide direct evidence of attacker activity. Option D, /var/log/auth.log, is correct because it records authentication events such as SSH logins, sudo usage, and failed/successful password attempts, which can reveal unauthorized access or brute-force activity. Option E, /home/user/.bash_history, is correct because it preserves the commands a user (or an attacker operating under that account) executed, often exposing reconnaissance, privilege escalation, or data exfiltration commands. Option A, /proc/cpuinfo, is not relevant because it only exposes CPU hardware details from the kernel and contains no record of user or attacker actions. Option C, /etc/passwd, is not the best evidence of activity because it is a static account database listing users; while tampering (e.g., a rogue UID 0 account) could be suspicious, the file itself does not log activity, and the question asks for artifacts evidencing attacker activity.

Answer

/proc/cpuinfo

Answer

/etc/passwd

Question 12

During memory analysis using Volatility, an analyst wants to identify processes that may be hiding. Which TWO plugins are most useful for detecting hidden or injected code? (Choose two.)

Accepted Answer

malfind. Option A, malfind, is correct because it scans process memory for regions with suspicious characteristics typical of injected or hidden code, such as pages marked PAGE_EXECUTE_READWRITE (RWX) or memory that is not backed by a file on disk, which is a strong indicator of code injection or process hollowing. Option D, psxview, is correct because it cross-references multiple process-listing sources (e.g., pslist, psscan, thrdscan, csrss handles, session processes) and highlights discrepancies where a process appears in some listings but not others, which is a classic sign of a hidden process. Option B, pslist, is not correct here because it simply walks the active process linked list and will not reveal processes that have been unlinked to hide themselves. Option C, dlllist, is not correct because it enumerates loaded DLLs for a given process and does not by itself detect hidden processes or injected code. Option E, cmdline, is not correct because it only retrieves process command-line arguments and provides no mechanism for detecting hidden or injected code.

Answer

pslist

Answer

dlllist

Answer

cmdline

Question 13

A security analyst is investigating a Windows workstation that experienced a series of failed logon attempts followed by a successful logon. Which TWO Windows Event IDs should the analyst examine to understand this activity?

Accepted Answer

4624 - An account was successfully logged on. The scenario describes failed logon attempts followed by a successful logon, so the analyst needs the events that directly record those two outcomes. Option A (4624 - An account was successfully logged on) is correct because Event ID 4624 is generated in the Security log whenever a logon succeeds, capturing details such as the account name, logon type, and source workstation that confirm the successful authentication. Option E (4625 - An account failed to log on) is correct because Event ID 4625 is logged for each failed authentication attempt and includes the failure reason, account name, and logon type, which together with 4624 reveals the brute-force-then-success pattern. Option B (4720 - A user account was created) is not relevant because it records account creation, not authentication activity. Option C (4648 - A logon was attempted using explicit credentials) is not relevant because it logs use of alternate credentials (e.g., RunAs), not the failed/successful logon sequence described. Option D (4776 - The domain controller attempted to validate the credentials for an account) is not relevant because it is a credential-validation event on a domain controller, not the workstation logon success/failure events the analyst needs.

Answer

4720 - A user account was created

Answer

4648 - A logon was attempted using explicit credentials

Answer

4776 - The domain controller attempted to validate the credentials for an account

Question 14

A Windows analyst uses Process Explorer to investigate parent-child relationships. Which TWO characteristics are commonly associated with malicious processes?

Accepted Answer

A process running from a user's Temp folder with a random name. Option B is correct because malware frequently drops and executes its payload from user-writable directories such as %TEMP% (e.g., C:\Users\<user>\AppData\Local\Temp) using randomized file names to evade signature-based detection and blend into transient files. Option E is correct because a document reader like winword.exe spawning a command interpreter such as cmd.exe (or powershell.exe) is a classic indicator of a malicious macro or exploit performing code execution, since legitimate Word usage does not normally launch shells. Option A is not suspicious by itself, as validly signed parent processes are typical of legitimate software and signatures indicate trustworthiness rather than malice. Option C describes benign behavior, since long uptime with low CPU is normal for many background services. Option D is also not inherently malicious, because svchost.exe spawning explorer.exe can occur in legitimate scenarios and is not a standard malware parent-child pattern.

Answer

A parent process with a valid digital signature

Answer

A process with a long uptime and low CPU usage

Answer

A process chain where the parent is svchost.exe and child is explorer.exe

Question 15

A SOC analyst is reviewing a Windows 10 endpoint after a suspected compromise. They need to determine which user account was responsible for a specific process that was launched shortly before the alert. Which Windows artifact directly records the user account associated with process creation events and should be queried using Windows Event Log?

Accepted Answer

Security Event ID 4688 with the associated user account field. When process creation auditing is enabled, Windows logs Security Event ID 4688 for each new process, and the event includes the subject user name that initiated it. Correlating the process name and timestamp in 4688 with the alert time lets the analyst attribute the suspicious process to a specific user account, which is exactly what is needed here.

Answer

Security Event ID 4625 with the Account Name field

Answer

System Event ID 7045 with the ServiceName field

Answer

Application Event ID 1000 with the Faulting application name field