200-201 Host-Based Analysis Practice Question
An analyst is examining a suspicious file that appears to be a PDF but when checking the magic bytes at offset 0, sees '50 4B 03 04'. What does this indicate?
⚠ Common exam trap
200-201 often tests whether candidates trust file extensions over actual file signatures — the trap is assuming a .pdf extension means the file is a PDF, when magic bytes reveal the true type.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file is a ZIP archive
The magic bytes '50 4B 03 04' at offset 0 are the ZIP file signature (PK\x03\x04). A genuine PDF must begin with '%PDF' (hex 25 50 44 46). Since the file claims to be a PDF but its header identifies it as a ZIP archive, this is a classic file-extension spoofing or polyglot technique used by malware to evade detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file is a genuine PDF file
Why it's wrong here
Bytes 50 4B 03 04 are the ZIP local file header signature, not the PDF marker 25 50 44 46, so the file is not a genuine PDF. It is tempting because PDFs are ZIP-based containers, but that structure sits inside the file, not at offset 0.
- ✗
The file is a plain text file
Why it's wrong here
Plain text files carry no magic bytes at all, so a defined signature at offset 0 rules that out. It is tempting because text editors display many file types, but the presence of 50 4B 03 04 specifically identifies a ZIP archive rather than unformatted text.
- ✓
The file is a ZIP archive
Why this is correct
The magic bytes 50 4B 03 04 are the ZIP local file header signature ('PK\x03\x04'). Despite the .pdf extension, the file's actual container format is ZIP, which is typical of Office documents and JAR archives and indicates the extension has been spoofed.
- ✗
The file is an executable
Why it's wrong here
50 4B 03 04 identifies a ZIP archive, not a Windows executable, whose magic bytes are 4D 5A. It is tempting because executables can be disguised with misleading extensions, but the signature here points to an archive, which may merely contain an executable.
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.