200-201 Host-Based Analysis Practice Test 9 — 15 Questions

Question 1

A junior analyst is asked to review a Linux server for evidence of unauthorized access. They want to see a chronological record of authentication-related messages, including successful and failed logins, generated by the system's authentication services. Which file should the analyst examine?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

/var/log/auth.log. Authentication-related messages on Debian and Ubuntu are written to /var/log/auth.log by services such as sshd, sudo, and PAM. Because this file captures both successful and failed login attempts in chronological order, it is the correct source for reviewing unauthorized access on the server.

Answer

/var/log/dpkg.log

Answer

/var/log/boot.log

Answer

/var/log/kern.log

Question 2

A threat hunter is examining a Windows 10 host and wants to determine whether a suspicious executable was recently run by a user. The hunter knows that Windows records application execution history in the registry under the UserAssist key. Which location should the hunter inspect to find this data for the currently logged-on user?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count. UserAssist under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist stores per-user execution history for programs launched through Explorer. The Count subkey under each GUID contains ROT13-encoded values that include the program path and a run counter, letting the hunter confirm recent execution by the current user.

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store

Answer

HKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings

Question 3

A security analyst is reviewing a Windows host for indicators of credential dumping. The analyst wants to identify artifacts that commonly indicate tools such as Mimikatz have been used on the system. Which two artifacts should the analyst look for? (Choose two.)

Accepted Answer

Security Event ID 4656 or 4663 referencing lsass.exe with unusual access rights. Credential dumping targets LSASS memory, so the most reliable host artifacts are security events showing unusual handle access to lsass.exe and the presence of a memory dump file such as lsass.dmp in a user-writable location. Together these indicate that a tool attempted to extract credentials from LSASS on the endpoint.

Answer

An increase in Windows Defender signature definition version numbers

Answer

Presence of a driver named SysmonDrv.sys in the System32\drivers directory

Answer

Event ID 4688 showing the launch of notepad.exe by the SYSTEM account

Question 4

A SOC analyst is reviewing a Windows 10 endpoint that is suspected of being compromised by malware that hides its network connections. The analyst runs 'netstat -anob' on the live system but does not see any suspicious outbound connections. Which Windows artifact should the analyst examine next to identify network connections that may have been hidden from the live API?

Accepted Answer

The SRUM database (SRUDB.dat) parsed with a tool such as srum-dump. SRUM maintains a rolling record of per-application resource usage, including bytes sent and received and network interface activity, in the SRUDB.dat ESE database. Because it is populated by the SRUM service rather than by the APIs malware commonly hooks to hide from netstat or GetTcpTable, it can surface external communications that live commands miss. Parsing SRUM therefore gives the analyst network evidence the live system concealed.

Answer

The Amcache.hve registry hive parsed with AmcacheParser

Answer

The ShimCache (AppCompatCache) entries in the SYSTEM hive

Answer

The Windows Prefetch files parsed with PECmd

Question 5

During an incident response engagement, an analyst is examining a Windows Server 2019 host that is suspected of being compromised. The analyst wants to determine which user accounts were used to log on interactively to the console in the last 24 hours. Which Windows artifact should the analyst query to obtain this information?

Accepted Answer

Security Event ID 4624 with Logon Type 2. Successful interactive logons at the console are recorded as Security Event ID 4624 with Logon Type 2. Filtering for that combination and the last 24 hours gives the analyst the specific accounts used for interactive console access on the server, which is exactly the requested scope.

Answer

Security Event ID 4672 with Logon Type 2

Answer

Security Event ID 4624 with Logon Type 3

Answer

Security Event ID 4634 with Logon Type 2

Question 6

A security analyst is investigating a Linux server that was compromised. The attacker used a rootkit to hide processes and files. The analyst runs 'lsmod' and notices a kernel module named 'hideproc' that is not recognized. Which command should the analyst use to determine the module's file path and potentially identify the rootkit?

Accepted Answer

modinfo hideproc. The analyst needs to find the file path of the suspicious kernel module to analyze or remove it. The modinfo command provides detailed information about a module, including its filename and location. This is the correct tool for identifying where the rootkit module resides on disk, enabling further forensic analysis or cleanup.

Answer

lsmod | grep hideproc

Answer

dmesg | grep hideproc

Answer

rmmod hideproc

Question 7

An analyst is investigating a Windows workstation that exhibits suspicious outbound network traffic. The analyst suspects a malicious process is injecting code into a legitimate process. Which of the following Windows Event Log sources would MOST likely contain evidence of process creation and image loading that could reveal the injection?

Accepted Answer

Microsoft-Windows-Sysmon/Operational. Sysmon, when installed, provides extensive logging of process creation and image loads, which are critical for identifying code injection. The Microsoft-Windows-Sysmon/Operational log contains Event ID 7 for image loads, allowing analysts to see if a process loaded an unexpected DLL, a common sign of injection.

Answer

System

Answer

Security

Answer

Application

Question 8

A security analyst is reviewing a Windows 10 endpoint that is suspected of being compromised. The analyst opens Task Manager and notices a process named 'lsass.exe' running with a PID of 1234, but its parent process is 'cmd.exe' rather than 'wininit.exe'. The analyst also observes that the process path is 'C:\Users\Public\lsass.exe'. Which type of attack is most likely indicated by these findings?

Accepted Answer

Process masquerading. The genuine lsass.exe runs from C:\Windows\System32 and is spawned by wininit.exe. A process named lsass.exe running from C:\Users\Public with cmd.exe as its parent is a strong indicator of process masquerading, where malware mimics a legitimate process name to evade detection. This technique is commonly used by attackers to blend in with normal system activity.

Answer

Rootkit infection

Answer

Process hollowing

Answer

DLL injection

Question 9

A security analyst is examining a Linux host and wants to identify which user account was used to execute a specific command that modified a critical system file. Which of the following files would provide the MOST direct evidence of the user who executed the command?

Accepted Answer

/var/log/audit/audit.log. The audit log, managed by auditd, is designed to capture security-relevant events, including command execution with user context. It logs the UID and EUID, so an analyst can determine exactly which user account executed the command that modified the critical file. Other logs may not capture this level of detail.

Answer

/var/log/auth.log

Answer

/var/log/syslog

Answer

/home/<user>/.bash_history

Question 10

An analyst suspects a Windows workstation is beaconing to a command-and-control server. The host's DNS cache contains an entry for a domain that resolves to an IP address, but the analyst cannot find any active network connection or process associated with that domain. Which Windows artifact should the analyst examine to determine whether a process previously resolved this domain and when?

Accepted Answer

The DNS Client event log (Microsoft-Windows-DNS-Client/Operational). The Microsoft-Windows-DNS-Client/Operational log is designed to record DNS client query events, including the query name, query type, timestamp, and the process that initiated the query. When a host is beaconing, the DNS cache may only show the resolved IP, but the operational log can show which process resolved the domain and when, enabling the analyst to link the beaconing behavior to a specific executable.

Answer

The Windows Firewall log at %systemroot%\system32\LogFiles\Firewall\pfirewall.log

Answer

The Application event log

Answer

The System event log

Question 11

A security analyst is investigating a Linux server that is exhibiting unusual outbound network traffic. The analyst runs 'netstat -tulpn' and observes a listening service on TCP port 4444, but the process name is 'sshd'. The analyst knows that SSH normally listens on port 22. Which of the following is the most likely explanation for this finding?

Accepted Answer

A backdoor or reverse shell is masquerading as the SSH daemon.. The presence of a service named 'sshd' listening on port 4444, especially with unusual outbound traffic, is a red flag for a backdoor or reverse shell. Attackers frequently use common ports like 4444 for command-and-control and name their processes after legitimate services to blend in. Legitimate SSH should listen on port 22 unless explicitly changed, and such a change would be documented.

Answer

The server is running an SSH honeypot on port 4444 to attract attackers.

Answer

The SSH daemon is configured to use port 4444 for SFTP transfers only.

Answer

The SSH daemon has been reconfigured to listen on port 4444 for security through obscurity.

Question 12

An analyst is investigating a Windows system for potential malware persistence. The analyst discovers a scheduled task that runs a PowerShell script every hour. The script downloads and executes a payload from a remote server. Which of the following Windows artifacts would BEST provide the original creation time and the author of this scheduled task?

Accepted Answer

C:\Windows\System32\Tasks\<TaskName>. The scheduled task definition file in C:\Windows\System32\Tasks\ contains an XML representation that includes metadata such as the task's creation time and author. This is the most direct artifact for determining the origin of a suspicious scheduled task, as it is written when the task is created.

Answer

C:\Windows\Tasks\<TaskName>

Answer

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Operational.evtx

Answer

C:\Windows\Prefetch\<TaskName>.pf

Question 13

A security analyst is examining a Linux server that is suspected of being compromised. The analyst runs `ls -l /proc/<PID>/exe` for a suspicious process and sees that the symbolic link points to `/tmp/.hidden/update` but the file no longer exists on disk. Which conclusion is most accurate?

Accepted Answer

The executable file was deleted while the process is still running.. On Linux, the /proc//exe symlink points to the executable file. If that file is deleted while the process is running, the symlink remains but the target path is marked as deleted, and the file is no longer accessible via the filesystem. This is a known malware tactic to hinder forensic analysis. The analyst should copy /proc//exe to preserve the binary before the process terminates.

Answer

The process is a kernel thread and does not have an executable on disk.

Answer

The process is running from a memory-mapped file and has no on-disk executable.

Answer

The process is a zombie and has already terminated.

Question 14

A SOC analyst receives an alert about a Windows workstation that may be infected with malware. The analyst wants to examine the system's boot configuration to determine if the malware modified boot settings to disable driver signature enforcement. Which Windows tool should the analyst use to view the current boot configuration data?

Accepted Answer

bcdedit. The correct tool is bcdedit, which manages Windows Boot Configuration Data. Malware often modifies BCD settings such as nointegritychecks or testsigning to bypass driver signature enforcement and load malicious drivers. Inspecting BCD with bcdedit /enum reveals these modifications. Other tools like msconfig, regedit, or sigverif do not provide direct access to BCD settings, making them unsuitable for this task.

Answer

regedit

Answer

msconfig

Answer

sigverif

Question 15

A security analyst is investigating a Linux server that is suspected of being compromised. The analyst runs 'ls -l /proc/1234/exe' and sees the output: '/proc/1234/exe -> /tmp/.hidden/backdoor (deleted)'. What does this output indicate?

Accepted Answer

The process 1234 is running from a deleted executable file, which may indicate malware hiding its presence.. The output indicates that process 1234 is executing from a file that has been deleted from the filesystem. Malware often deletes its executable after launching to evade detection by file-based scans. The hidden directory and suspicious name 'backdoor' further suggest malicious intent. Therefore, the correct interpretation is that the process is running from a deleted executable, a common malware hiding technique.

Answer

The process 1234 is a legitimate system process that was updated, and the old executable was deleted.

Answer

The process 1234 is a zombie process that has terminated but still appears in the process list.

Answer

The process 1234 has a corrupted executable file that needs to be replaced.