200-201 Host-Based Analysis Practice Question
An analyst is examining a Linux system for persistence mechanisms. Which of the following files should be reviewed to detect cron-based persistence?
⚠ Common exam trap
Many candidates confuse log files or user account files with actual persistence configuration files; candidates might pick /var/log/auth.log because it logs cron activity, but the question asks for the file to review to detect the persistence mechanism itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
/var/spool/cron/crontabs
The correct answer is /var/spool/cron/crontabs because this directory stores user-specific cron jobs on Debian-based Linux systems. Attackers often add malicious entries here to maintain persistence by scheduling recurring tasks. Reviewing this directory reveals unauthorized scheduled jobs that could execute malware or reverse shells at regular intervals.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
/var/log/auth.log
Why it's wrong here
/var/log/auth.log records authentication events such as logins and sudo use, not scheduled job definitions, so it cannot reveal cron persistence. It is tempting because analysts routinely review it for intrusion evidence, and it would be the right file when investigating failed logins or privilege escalation rather than persistence.
- ✗
/etc/passwd
Why it's wrong here
/etc/passwd holds local account records, not scheduled job definitions, so it cannot reveal cron persistence. It is tempting because attackers sometimes add rogue accounts for persistence, and it would be the correct file when checking for unauthorised user accounts rather than recurring scheduled execution.
- ✗
/home/user/.bash_history
Why it's wrong here
/home/user/.bash_history lists previously typed shell commands, which may hint at cron use but contains no scheduled job definitions, so it cannot confirm cron persistence. It is tempting because attackers' commands often appear there; it would be correct when reconstructing a user's interactive activity rather than enumerating active scheduled tasks.
- ✓
/var/spool/cron/crontabs
Why this is correct
User crontab entries are stored under /var/spool/cron/crontabs, one file per user, so reviewing this directory reveals scheduled jobs an attacker added for persistence. System-wide schedules live in /etc/crontab and /etc/cron.d, making this the correct user-level location.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.