200-201 Host-Based Analysis Practice Question
A forensic analyst is examining a suspicious file. The file has a high entropy score (close to 8.0) and the PE section names are obfuscated. Which tool or technique would best help determine if the file is packed?
⚠ Common exam trap
Candidates often confuse file identification (the 'file' command) or string extraction with actual packer detection — candidates pick 'strings' because it's a common first-step tool, but entropy analysis of PE sections is the specific technique that answers the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Analyze the PE sections and calculate entropy to detect packing
High entropy (close to 8.0) indicates the file's byte distribution is nearly random, which is characteristic of compressed or encrypted data — exactly what packers produce. Combined with obfuscated PE section names (e.g., UPX0, .aspack, or random strings), analyzing PE section headers and computing per-section entropy is the definitive method to confirm packing. Tools like PEiD, Detect It Easy, or pefile in Python automate this by flagging sections with entropy >7.0 and non-standard names.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the 'strings' command to extract readable strings
Why it's wrong here
Packed executables deliberately compress or encrypt their payload, so 'strings' yields few readable strings and cannot confirm packing. It is tempting as a fast triage technique for revealing embedded URLs or commands in unpacked malware, but here the obfuscated PE sections and near-8.0 entropy demand structural PE analysis instead.
- ✗
Check the file's digital signature
Why it's wrong here
A digital signature verifies publisher authenticity and integrity, not whether the executable's code is compressed; packed malware is frequently unsigned, so absence of a signature proves nothing about packing. Signature checking suits validating trusted software provenance, whereas packing is confirmed by inspecting PE section entropy and raw-size versus virtual-size discrepancies.
- ✗
Run the 'file' command in Linux
Why it's wrong here
The 'file' command identifies a file's type via magic-number signatures, which packing does not alter, so it cannot reveal compression. It is tempting because it is a quick triage step for unknown samples, but detecting packed PE code requires examining section entropy and import tables, typically with PEiD or a PE analysis tool.
- ✓
Analyze the PE sections and calculate entropy to detect packing
Why this is correct
Analysing PE section entropy directly identifies packing: packed executables compress or encrypt their payload, producing entropy near 8.0 and obfuscated section names such as UPX0. This technique satisfies the stem's requirement to confirm packing by examining the suspicious file's structural characteristics rather than relying on runtime behaviour.
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.