200-201 Host-Based Analysis Practice Question
A security analyst is analyzing a suspicious PE file. Using a hex editor, the analyst sees the ASCII string 'MZ' at the beginning. What does this indicate?
⚠ Common exam trap
200-201 often tests magic-number recognition, and candidates confuse 'MZ' (Windows PE/DOS) with 'ELF' (Linux) or 'PDF' signatures — the key is memorizing the exact byte sequences for each file type.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file is a Windows Portable Executable
The ASCII string 'MZ' at the beginning of a file is the DOS MZ header signature, which identifies the file as a Windows Portable Executable (PE) or a DOS executable. 'MZ' stands for Mark Zbikowski, the Microsoft engineer who designed the format. This signature is the first two bytes of every PE file and is used by Windows loaders to recognize executable images.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file is a plain text file
Why it's wrong here
'MZ' is the DOS header signature of a Windows PE executable, not a marker of plain text, which contains no fixed magic bytes. It is tempting because ASCII characters appear readable in a hex editor, but that option would be correct only when examining an actual text file.
- ✓
The file is a Windows Portable Executable
Why this is correct
The ASCII characters 'MZ' (0x4D5A) form the DOS header magic number that every Windows Portable Executable begins with, as defined by the PE format specification. Its presence at offset zero identifies the file as a Windows PE binary rather than a script or document.
- ✗
The file is a Linux ELF binary
Why it's wrong here
The 'MZ' signature identifies a Windows Portable Executable DOS header, not a Linux ELF binary, which begins with the 0x7F 'ELF' magic bytes. It is tempting because both are executable file formats, and ELF would be the correct identification had the hex editor shown 7F 45 4C 46 at the file's start.
- ✗
The file is a PDF document
Why it's wrong here
PDF files begin with the '%PDF' signature, not 'MZ', which is the DOS header magic identifying a Windows PE executable. It is tempting because both are document or executable file types viewed in hex, but PDF would be the answer had the analyst seen '%PDF-1.' at offset zero.
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.