200-201 Host-Based Analysis Practice Question
An analyst is examining a Linux system for signs of an attacker establishing persistence. Which TWO of the following locations should the analyst check? (Choose two.)
⚠ Common exam trap
200-201 often tests persistence locations, and candidates confuse forensic artifacts (like .bash_history) with actual persistence mechanisms — the key is identifying locations that cause automatic code execution across reboots or schedules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
/etc/systemd/system/
Option C, /etc/systemd/system/, is correct because attackers commonly drop malicious .service unit files there to establish persistence via systemd, causing their payload to execute at boot or on a trigger. Option D, /etc/crontab, is correct because scheduled tasks in this file (and related cron directories) are a classic persistence mechanism, allowing an attacker to re-execute code at defined intervals. Option A, /etc/passwd, is not the best choice here since it stores user account information rather than a direct persistence trigger, though it can be abused to add accounts. Option B, /proc/self/status, is a runtime process status file and does not provide a persistence location. Option E, /home/user/.bash_history, is useful for forensic reconstruction of past commands but is not itself a persistence mechanism.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
/etc/passwd
Why it's wrong here
/etc/passwd lists user accounts but not persistence directly.
- ✗
/proc/self/status
Why it's wrong here
/proc is a virtual filesystem for running processes, not persistence.
- ✓
/etc/systemd/system/
Why this is correct
Correct. Systemd services can be used for persistence.
- ✓
/etc/crontab
Why this is correct
Correct. Cron jobs can run malicious scripts at scheduled times.
- ✗
/home/user/.bash_history
Why it's wrong here
Bash history records commands, not persistence mechanisms.
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.