200-201 Host-Based Analysis Practice Question
An analyst examining a Linux server notices an unusual cron job in /etc/crontab that runs a script every 5 minutes. Which of the following describes the best approach to determine if this cron job is malicious?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the script's content, owner, and compare its hash with known threats.
Inspecting the script content and correlating with known persistence techniques helps assess maliciousness.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ignore it because cron jobs are always legitimate.
Why it's wrong here
Malware often uses cron for persistence.
- ✗
Delete the cron job immediately to stop potential malicious activity.
Why it's wrong here
Deleting without analysis destroys evidence.
- ✓
Check the script's content, owner, and compare its hash with known threats.
Why this is correct
Analyzing the script and its origin is crucial for determination.
- ✗
Run the script in a sandbox to see what it does.
Why it's wrong here
Running unknown scripts is risky and may cause infection; analysis of content is safer.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.