200-201 Host-Based Analysis Practice Question
An analyst is using Volatility's 'pslist' and 'pstree' commands on a memory dump. The output shows a process named 'lsass.exe' with a PID of 1024. However, the usual PID for lsass.exe on this system is 512. What does this discrepancy likely indicate?
⚠ Common exam trap
Cisco often tests the misconception that PIDs are random or always change between boots, but in reality, critical system processes like lsass.exe have predictable PIDs due to their fixed boot order, making any significant deviation a clear sign of compromise.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It indicates a possible process hollowing or masquerading attack
The 'lsass.exe' process (Local Security Authority Subsystem Service) is a critical Windows system process responsible for enforcing security policies and handling authentication. Under normal conditions, lsass.exe runs as a child of 'winlogon.exe' or 'services.exe' with a consistent PID (often 512 or 528) across boots on a given system. A PID of 1024, especially when the known baseline is 512, strongly suggests that a malicious actor has spawned a fake 'lsass.exe' process via process hollowing (replacing the legitimate process's memory with malicious code) or masquerading (naming a malicious binary to mimic the legitimate one) to evade detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It indicates a possible process hollowing or masquerading attack
Why this is correct
Correct. Anomalous PID for lsass is suspicious.
- ✗
It shows that the system has multiple instances of lsass running
Why it's wrong here
Only one lsass should run.
- ✗
It is normal; the PID can vary between system boots
Why it's wrong here
Critical system processes like lsass have static PIDs.
- ✗
It suggests the process is a legitimate child of services.exe
Why it's wrong here
Even if child, PID should match expected value.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.