Host-Based Analysis →hardMultiple SelectObjective-mapped

200-201 Host-Based Analysis Practice Question

A security analyst is examining a Linux system suspected of compromise. Which THREE artifacts should be reviewed to identify potential persistence mechanisms?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Cron jobs in /etc/crontab and /var/spool/cron/

Cron jobs, systemd services, and bash history are key for persistence detection. SSH keys can also be used. /proc/cpuinfo is hardware info, not persistence.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Authorized SSH keys in ~/.ssh/authorized_keys
Why it's wrong here
SSH keys are used for remote access, not typically for persistence (though could be used for lateral movement).
✗
/proc/cpuinfo
Why it's wrong here
This file contains CPU information, not persistence.
✓
Cron jobs in /etc/crontab and /var/spool/cron/
Why this is correct
Cron jobs can be used to execute malicious scripts periodically.
✓
Bash history in /home/*/.bash_history
Why this is correct
Bash history may reveal commands used to set up persistence.
✓
Systemd services in /etc/systemd/system/
Why this is correct
Malicious systemd services can start automatically on boot.

Go deeper

200-201 Host-Based Analysis Practice Question

Why each option matters

Option-by-option breakdown

Related to this question