200-201 Host-Based Analysis — Timed 15 Questions

Question 1

A security analyst is investigating a host that is suspected of being used as a pivot point in a network intrusion. The analyst needs to identify which process initiated an outbound connection to a known malicious IP address. Which host-based analysis approach should the analyst use to correlate the network connection to the specific process?

Accepted Answer

Run 'netstat -b' on the Windows host to display active connections with the associated process executable.. Running 'netstat -b' on a Windows host displays active TCP connections along with the executable name of the process that created each connection. This directly correlates the outbound connection to the malicious IP with the specific process, which is exactly what the analyst needs to identify the pivot point.

Answer

Examine the Windows Firewall log to see the source and destination IP addresses and ports for outbound traffic.

Answer

Review Windows Security Event Log for Event ID 4688 (Process Creation) for the timeline of process starts.

Answer

Use PowerShell cmdlet 'Get-NetTCPConnection' to list current TCP connections and their states.

Question 2

Refer to the exhibit. A security analyst is analyzing a Windows host that is communicating with an external server at 192.168.1.50. Based on the output, which process is likely malicious?

Accepted Answer

powershell.exe (PID 2792) because it has an established HTTPS connection to an external server.. PowerShell.exe (PID 2792) is the likely malicious process because it has an established HTTPS connection (TCP port 443) to an external server at 192.168.1.50. PowerShell is a powerful scripting tool often abused by attackers to execute arbitrary code, download payloads, or establish command-and-control (C2) channels over encrypted HTTPS, which can evade detection by traditional signature-based security tools.

Answer

svchost.exe (PID 1420) because it is connecting to an external IP on port 80.

Answer

cmd.exe (PID 2568) because it could be used to launch other processes.

Answer

notepad.exe (PID 2344) because it is not expecting to make any network connections.

Question 3

A security analyst is investigating a host that is suspected of being compromised. The analyst runs a series of commands to gather information. Which TWO of the following commands are most useful for collecting volatile data from a live Windows system? (Choose two.)

Accepted Answer

netstat -anob. The `netstat -anob` command displays active network connections, listening ports, and the associated process IDs (PIDs) along with the executable name. This is critical for identifying unauthorized outbound connections or backdoor listeners that indicate compromise. Because network state and process-to-port mappings reside in volatile memory (RAM), they are lost on reboot, making this command essential for live forensic collection.

Answer

dir /s C:\Windows\System32\config

Answer

wevtutil qe System /c:10

Answer

reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Question 4

Refer to the exhibit. A network analyst sees repeated denied attempts from host 10.0.0.2 to 10.0.0.1 on port 23. Based on the log, what type of activity is most likely occurring?

Accepted Answer

Brute force attempt on Telnet service. The log shows repeated denied attempts from host 10.0.0.2 to 10.0.0.1 on port 23, which is the default port for Telnet. Multiple failed connection attempts to a Telnet service indicate a brute force attack, where an attacker tries to guess credentials by repeatedly attempting to log in.

Answer

DNS amplification attack

Answer

ARP spoofing

Answer

ICMP flood attack

Question 5

A security analyst is responding to an incident on a critical Windows server that hosts a database application. The server is running Windows Server 2019 with all current patches. The analyst suspects that a remote attacker gained access and is using living-off-the-land binaries to move laterally. The analyst has captured a memory dump and a full disk image. The analyst needs to determine if the attacker used PowerShell to download additional tools. Which analysis step should the analyst perform first to identify PowerShell usage?

Accepted Answer

Parse PowerShell operational logs (Event ID 4104) to extract executed scripts and commands.. PowerShell operational logs, specifically Event ID 4104 (Script Block Logging), capture the full text of PowerShell scripts and commands executed on the system. Since the analyst suspects the attacker used PowerShell to download additional tools, parsing these logs is the most direct and efficient first step to confirm that activity. This log source provides the actual commands run, including any download commands like Invoke-WebRequest or Start-BitsTransfer, without relying on indirect artifacts.

Answer

Examine the Windows Registry for Run keys to identify persistence mechanisms.

Answer

Review prefetch files (.pf) to determine when PowerShell was last executed.

Answer

Analyze network connection logs to identify outbound connections to known malicious IPs.

Question 6

An analyst is investigating a host that is suspected of being compromised. The host's security logs show multiple failed login attempts followed by a successful login from an unusual IP address, and then a series of outbound connections to known malicious destinations. Which TWO actions should the analyst take immediately? (Choose two.)

Accepted Answer

Isolate the host from the network. Option B is correct because isolating the host from the network immediately stops the outbound connections to known malicious destinations, preventing further data exfiltration, lateral movement, or command-and-control (C2) communication. This containment step is critical in incident response to limit the blast radius before any other investigative or remediation actions are taken.

Answer

Delete the malicious files found on the host

Answer

Reboot the host to clear any malware from memory

Answer

Run a full antivirus scan on the host

Question 7

Refer to the exhibit. An analyst runs the command 'tasklist /svc /fi "PID eq 1234"' on a Windows host and receives the output shown. Which conclusion can the analyst draw from this output?

Accepted Answer

The process is a legitimate Windows service host. The 'tasklist /svc /fi "PID eq 1234"' command filters for a specific PID and displays the associated services. The output shows 'svchost.exe' with the service 'DcomLaunch', which is a core Windows component responsible for launching COM and DCOM services. This confirms the process is a legitimate Windows service host, not a third-party application or malware.

Answer

The process is a third-party application

Answer

The process is using excessive CPU resources

Answer

The process is likely malware masquerading as svchost.exe

Question 8

An organization uses Windows 10 Enterprise workstations with standard user accounts (no local admin). Users run daily tasks including web browsing, document editing, and accessing a corporate intranet. Recently, the security team detected anomalous outbound traffic from one workstation to an IP address in a foreign country. The workstation's host-based firewall shows that a process named 'svch0st.exe' initiated the connection. Additionally, a scheduled task named 'UpdateTask' runs every hour with SYSTEM privileges, executing a script from a hidden folder. The user reports no unusual behavior except occasional system slowdowns. The analyst must determine the best immediate course of action. Which action should the analyst take first?

Accepted Answer

Disable the scheduled task and terminate the svch0st.exe process, then collect a forensic image of the workstation for further analysis. Option D is correct because the immediate priority is to contain the threat by disabling the scheduled task and terminating the malicious process (svch0st.exe) to stop further outbound communication, while preserving the system state for forensic analysis. Collecting a forensic image ensures that evidence (e.g., the script, scheduled task artifacts, and network logs) is not destroyed, allowing the security team to perform root-cause analysis and determine the full scope of the compromise. This approach balances containment with evidence preservation, which is critical in incident response.

Answer

Run an antivirus scan and if nothing is found, ignore the alert as a false positive

Answer

Immediately disconnect the workstation from the network and perform a full system restore from a known good backup

Answer

Delete the scheduled task and the script from the hidden folder, then reboot the workstation

Question 9

Drag and drop the steps to investigate a security incident using a SIEM into the correct order.

Question 10

Drag and drop the steps to configure a Cisco ASA firewall for basic network access into the correct order.

Question 11

Match each Windows event log type to its description.

Question 12

Match each log severity level to its description (syslog).

Question 13

A security analyst notices that a workstation is generating multiple DNS queries to a known malicious domain. Which host-based analysis technique would be most effective in confirming the infection?

Accepted Answer

Use Process Explorer to examine the process responsible for the DNS queries. Process Explorer is a host-based analysis tool that provides detailed information about running processes, including their network connections and DNS queries. By examining the process responsible for the DNS queries to the known malicious domain, the analyst can directly identify the infected executable or script, confirming the infection at the process level.

Answer

Review the Windows Firewall logs to see blocked connections

Answer

Check the scheduled tasks for suspicious entries

Answer

Analyze the Windows Event Log for Event ID 5156

Question 14

A SOC analyst is investigating a suspicious file on a Windows host. The file hash matches a known malware variant in a threat intelligence feed. What is the next best step for host-based analysis?

Accepted Answer

Check for persistence mechanisms such as registry Run keys or scheduled tasks. Option C is correct because after confirming a file hash matches a known malware variant, the immediate priority for host-based analysis is to determine how the malware maintains persistence on the system. Persistence mechanisms such as Registry Run keys (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) or scheduled tasks (via schtasks.exe) allow malware to survive reboots and re-establish execution. Identifying these artifacts is critical for containment and eradication, as it reveals the malware's foothold and prevents re-infection after removal.

Answer

Run a full antivirus scan on the host

Answer

Disable the network adapter to prevent further communication

Answer

Reboot the host to clear the malware from memory

Question 15

An analyst is examining a Linux host suspected of being compromised. The file /etc/passwd shows unusual entries. Which host-based analysis tool is best for verifying if the accounts are actively being used?

Accepted Answer

last command output. The `last` command reads the /var/log/wtmp file to display a list of all users who have logged in and out, including their login times and durations. Since the question asks whether suspicious accounts from /etc/passwd are actively being used, `last` directly shows recent login activity, making it the best tool for verification.

Answer

lsof tool

Answer

ps aux command

Answer

auditd logs