Host-Based Analysis practice questions

A security analyst is investigating a host that is suspected of being used as a pivot point in a network intrusion. The analyst needs to identify which process initiated an outbound connection to a known malicious IP address. Which host-based analysis approach should the analyst use to correlate the network connection to the specific process?

Trap 1: Examine the Windows Firewall log to see the source and destination…

Firewall logs show network traffic but do not identify the process that initiated it.

Trap 2: Review Windows Security Event Log for Event ID 4688 (Process…

Event ID 4688 shows process creation events but does not directly link them to network connections.

Trap 3: Use PowerShell cmdlet 'Get-NetTCPConnection' to list current TCP…

Get-NetTCPConnection provides connection details but lacks the owning process information without additional options.

A
Run 'netstat -b' on the Windows host to display active connections with the associated process executable.
The -b flag shows the binary involved in creating each connection, directly correlating the connection to the process.
B
Examine the Windows Firewall log to see the source and destination IP addresses and ports for outbound traffic.
Why wrong: Firewall logs show network traffic but do not identify the process that initiated it.
C
Review Windows Security Event Log for Event ID 4688 (Process Creation) for the timeline of process starts.
Why wrong: Event ID 4688 shows process creation events but does not directly link them to network connections.
D
Use PowerShell cmdlet 'Get-NetTCPConnection' to list current TCP connections and their states.
Why wrong: Get-NetTCPConnection provides connection details but lacks the owning process information without additional options.

Question 2hardmultiple choice

Refer to the exhibit. A security analyst is analyzing a Windows host that is communicating with an external server at 192.168.1.50. Based on the output, which process is likely malicious?

Exhibit

Refer to the exhibit.

C:\Users\Admin> tasklist /svc
Image Name                     PID Services
========================= ======== ============================================
svchost.exe                    1236 BrokerInfrastructure, DcomLaunch, PlugPlay
svchost.exe                    1420 RpcSs, LanmanWorkstation, Dhcp, NlaSvc
svchost.exe                    1508 WpnService, WpnUserService
notepad.exe                    2344 N/A
cmd.exe                        2568 N/A
powershell.exe                 2792 N/A

C:\Users\Admin> netstat -anob | findstr 192.168.1.50
  TCP    192.168.1.100:49152    192.168.1.50:443    ESTABLISHED     2792
  TCP    192.168.1.100:49153    192.168.1.50:80     ESTABLISHED     1420

Trap 1: svchost.exe (PID 1420) because it is connecting to an external IP…

svchost.exe commonly hosts services that make HTTP connections; this alone is not suspicious.

Trap 2: cmd.exe (PID 2568) because it could be used to launch other…

Cmd.exe has no network connections; it is not directly communicating.

Trap 3: notepad.exe (PID 2344) because it is not expecting to make any…

Notepad.exe has no network connections in the output, so it is not involved.

A
svchost.exe (PID 1420) because it is connecting to an external IP on port 80.
Why wrong: svchost.exe commonly hosts services that make HTTP connections; this alone is not suspicious.
B
cmd.exe (PID 2568) because it could be used to launch other processes.
Why wrong: Cmd.exe has no network connections; it is not directly communicating.
C
powershell.exe (PID 2792) because it has an established HTTPS connection to an external server.
PowerShell making an outbound HTTPS connection is atypical and often used for malicious purposes.
D
notepad.exe (PID 2344) because it is not expecting to make any network connections.
Why wrong: Notepad.exe has no network connections in the output, so it is not involved.

Question 3easymulti select

A security analyst is investigating a host that is suspected of being compromised. The analyst runs a series of commands to gather information. Which TWO of the following commands are most useful for collecting volatile data from a live Windows system? (Choose two.)

Trap 1: dir /s C:\Windows\System32\config

Lists files; not typically volatile and can be performed after acquisition.

Trap 2: wevtutil qe System /c:10

Queries event logs; while useful, it is not considered volatile data.

Trap 3: reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Queries registry for startup programs; not as volatile as network/process info.

A
netstat -anob
Shows active network connections with associated process IDs and executables.
B
tasklist /svc
Lists processes and their services, crucial for identifying running malware.
C
dir /s C:\Windows\System32\config
Why wrong: Lists files; not typically volatile and can be performed after acquisition.
D
wevtutil qe System /c:10
Why wrong: Queries event logs; while useful, it is not considered volatile data.
E
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Why wrong: Queries registry for startup programs; not as volatile as network/process info.

Question 4mediummultiple choice

Refer to the exhibit. A network analyst sees repeated denied attempts from host 10.0.0.2 to 10.0.0.1 on port 23. Based on the log, what type of activity is most likely occurring?

Exhibit

Refer to the exhibit.

Mar  1 10:15:22 host1 syslog: [CISCO] %SEC-6-IPACCESSLOGP: list inbound denied tcp 10.0.0.2(49152) -> 10.0.0.1(23), 1 packet
Mar  1 10:15:23 host1 syslog: [CISCO] %SEC-6-IPACCESSLOGP: list inbound denied tcp 10.0.0.2(49153) -> 10.0.0.1(23), 1 packet
Mar  1 10:15:24 host1 syslog: [CISCO] %SEC-6-IPACCESSLOGP: list inbound denied tcp 10.0.0.2(49154) -> 10.0.0.1(23), 1 packet

Trap 1: DNS amplification attack

DNS amplification uses UDP port 53, not TCP port 23.

Trap 2: ARP spoofing

ARP spoofing involves ARP packets, not TCP log entries.

Trap 3: ICMP flood attack

ICMP flood would generate ICMP packets, not TCP connections to port 23.

A
DNS amplification attack
Why wrong: DNS amplification uses UDP port 53, not TCP port 23.
B
ARP spoofing
Why wrong: ARP spoofing involves ARP packets, not TCP log entries.
C
Brute force attempt on Telnet service
Multiple connection attempts to port 23 (Telnet) from the same source indicate a brute force or scanning activity.
D
ICMP flood attack
Why wrong: ICMP flood would generate ICMP packets, not TCP connections to port 23.

Question 5hardmultiple choice

A security analyst is responding to an incident on a critical Windows server that hosts a database application. The server is running Windows Server 2019 with all current patches. The analyst suspects that a remote attacker gained access and is using living-off-the-land binaries to move laterally. The analyst has captured a memory dump and a full disk image. The analyst needs to determine if the attacker used PowerShell to download additional tools. Which analysis step should the analyst perform first to identify PowerShell usage?

Trap 1: Examine the Windows Registry for Run keys to identify persistence…

Registry analysis may show persistence but does not reveal PowerShell command history.

Trap 2: Review prefetch files (.pf) to determine when PowerShell was last…

Prefetch shows execution times, not the commands executed.

Trap 3: Analyze network connection logs to identify outbound connections to…

Network logs show connections but not the PowerShell commands; they are indirect evidence.

A
Examine the Windows Registry for Run keys to identify persistence mechanisms.
Why wrong: Registry analysis may show persistence but does not reveal PowerShell command history.
B
Parse PowerShell operational logs (Event ID 4104) to extract executed scripts and commands.
PowerShell ScriptBlock logging captures the full script content, directly showing attacker commands.
C
Review prefetch files (.pf) to determine when PowerShell was last executed.
Why wrong: Prefetch shows execution times, not the commands executed.
D
Analyze network connection logs to identify outbound connections to known malicious IPs.
Why wrong: Network logs show connections but not the PowerShell commands; they are indirect evidence.

Question 6hardmulti select

An analyst is investigating a host that is suspected of being compromised. The host's security logs show multiple failed login attempts followed by a successful login from an unusual IP address, and then a series of outbound connections to known malicious destinations. Which TWO actions should the analyst take immediately? (Choose two.)

Trap 1: Delete the malicious files found on the host

Deleting files destroys evidence; preservation is critical.

Trap 2: Reboot the host to clear any malware from memory

Rebooting destroys volatile evidence and may allow malware to persist.

Trap 3: Run a full antivirus scan on the host

Running a scan may alter evidence and is not the immediate priority.

A
Delete the malicious files found on the host
Why wrong: Deleting files destroys evidence; preservation is critical.
B
Isolate the host from the network
Isolating the host stops ongoing malicious activity and prevents lateral movement.
C
Collect a forensic image of the host's hard drive
A forensic image preserves volatile and non-volatile evidence for detailed analysis.
D
Reboot the host to clear any malware from memory
Why wrong: Rebooting destroys volatile evidence and may allow malware to persist.
E
Run a full antivirus scan on the host
Why wrong: Running a scan may alter evidence and is not the immediate priority.

Question 7easymultiple choice

Refer to the exhibit. An analyst runs the command 'tasklist /svc /fi "PID eq 1234"' on a Windows host and receives the output shown. Which conclusion can the analyst draw from this output?

Exhibit

Refer to the exhibit.

tasklist /svc /fi "PID eq 1234"
Image Name                     PID Services
========================= ======== ============================================
svchost.exe                   1234 CryptSvc, Dnscache, LanmanWorkstation, W32Time

Trap 1: The process is a third-party application

The services listed (CryptSvc, Dnscache, etc.) are Windows system services, not third-party.

Trap 2: The process is using excessive CPU resources

The output does not include CPU usage information.

Trap 3: The process is likely malware masquerading as svchost.exe

While svchost.exe can be mimicked, the listed services are standard Windows services, so there is no indication of masquerading.

A
The process is a third-party application
Why wrong: The services listed (CryptSvc, Dnscache, etc.) are Windows system services, not third-party.
B
The process is using excessive CPU resources
Why wrong: The output does not include CPU usage information.
C
The process is a legitimate Windows service host
svchost.exe is a legitimate Windows process that hosts multiple system services.
D
The process is likely malware masquerading as svchost.exe
Why wrong: While svchost.exe can be mimicked, the listed services are standard Windows services, so there is no indication of masquerading.

Question 8mediummultiple choice

An organization uses Windows 10 Enterprise workstations with standard user accounts (no local admin). Users run daily tasks including web browsing, document editing, and accessing a corporate intranet. Recently, the security team detected anomalous outbound traffic from one workstation to an IP address in a foreign country. The workstation's host-based firewall shows that a process named 'svch0st.exe' initiated the connection. Additionally, a scheduled task named 'UpdateTask' runs every hour with SYSTEM privileges, executing a script from a hidden folder. The user reports no unusual behavior except occasional system slowdowns. The analyst must determine the best immediate course of action. Which action should the analyst take first?

Trap 1: Run an antivirus scan and if nothing is found, ignore the alert as…

Antivirus may not detect the malware, and ignoring could allow persistent access.

Trap 2: Immediately disconnect the workstation from the network and perform…

This is too drastic and may not preserve evidence; also, a restore could reintroduce the infection if the backup is compromised.

Trap 3: Delete the scheduled task and the script from the hidden folder,…

Deleting the script destroys evidence; the analyst should preserve it for analysis.

A
Run an antivirus scan and if nothing is found, ignore the alert as a false positive
Why wrong: Antivirus may not detect the malware, and ignoring could allow persistent access.
B
Immediately disconnect the workstation from the network and perform a full system restore from a known good backup
Why wrong: This is too drastic and may not preserve evidence; also, a restore could reintroduce the infection if the backup is compromised.
C
Delete the scheduled task and the script from the hidden folder, then reboot the workstation
Why wrong: Deleting the script destroys evidence; the analyst should preserve it for analysis.
D
Disable the scheduled task and terminate the svch0st.exe process, then collect a forensic image of the workstation for further analysis
This stops malicious activity while preserving the script and other evidence on disk for later analysis.

Question 9mediumdrag order

Drag and drop the steps to investigate a security incident using a SIEM into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 10mediumdrag order

Drag and drop the steps to configure a Cisco ASA firewall for basic network access into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 11mediummatching

Read the full network assurance explanation →

Match each Windows event log type to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Logs success/failure audit events

Logs operating system events

Logs events from applications

Logs installation events

Logs events forwarded from other computers

Question 12mediummatching

Match each log severity level to its description (syslog).

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

System is unusable

Immediate action required

Critical conditions

Error conditions

Warning conditions

Question 13easymultiple choice

Read the full DNS explanation →

A security analyst notices that a workstation is generating multiple DNS queries to a known malicious domain. Which host-based analysis technique would be most effective in confirming the infection?

Trap 1: Review the Windows Firewall logs to see blocked connections

Firewall logs may show outbound attempts but not necessarily identify the process.

Trap 2: Check the scheduled tasks for suspicious entries

Scheduled tasks could indicate persistence but may not show current activity.

Trap 3: Analyze the Windows Event Log for Event ID 5156

Event ID 5156 is a Windows Filtering Platform connection, but may not show DNS queries specifically.

A
Review the Windows Firewall logs to see blocked connections
Why wrong: Firewall logs may show outbound attempts but not necessarily identify the process.
B
Check the scheduled tasks for suspicious entries
Why wrong: Scheduled tasks could indicate persistence but may not show current activity.
C
Use Process Explorer to examine the process responsible for the DNS queries
Process Explorer can show network activity per process, directly linking the DNS queries to a specific executable.
D
Analyze the Windows Event Log for Event ID 5156
Why wrong: Event ID 5156 is a Windows Filtering Platform connection, but may not show DNS queries specifically.

Question 14easymultiple choice

A SOC analyst is investigating a suspicious file on a Windows host. The file hash matches a known malware variant in a threat intelligence feed. What is the next best step for host-based analysis?

Trap 1: Run a full antivirus scan on the host

AV is reactive and may not catch all variants; dynamic analysis is better.

Trap 2: Disable the network adapter to prevent further communication

Isolating the host is important, but analysis of persistence is needed before remediation.

Trap 3: Reboot the host to clear the malware from memory

Rebooting may destroy evidence and doesn't remove persistence.

A
Run a full antivirus scan on the host
Why wrong: AV is reactive and may not catch all variants; dynamic analysis is better.
B
Disable the network adapter to prevent further communication
Why wrong: Isolating the host is important, but analysis of persistence is needed before remediation.
C
Check for persistence mechanisms such as registry Run keys or scheduled tasks
Malware often adds persistence. Examining startup locations helps determine scope and removal.
D
Reboot the host to clear the malware from memory
Why wrong: Rebooting may destroy evidence and doesn't remove persistence.

Question 15mediummultiple choice

An analyst is examining a Linux host suspected of being compromised. The file /etc/passwd shows unusual entries. Which host-based analysis tool is best for verifying if the accounts are actively being used?

Trap 1: lsof tool

lsof lists open files, not login history.

Trap 2: ps aux command

ps shows running processes, not account activity.

Trap 3: auditd logs

auditd logs system calls but not specifically login events for all accounts.

A
lsof tool
Why wrong: lsof lists open files, not login history.
B
ps aux command
Why wrong: ps shows running processes, not account activity.
C
last command output
last reads /var/log/wtmp and shows login sessions, indicating active use.
D
auditd logs
Why wrong: auditd logs system calls but not specifically login events for all accounts.

Question 16mediummultiple choice

During a host-based investigation, an analyst finds a process named 'svchost.exe' consuming high CPU. The process path is 'C:\Windows\Temp\svchost.exe'. What should the analyst conclude?

Trap 1: It is a legitimate Windows service host process

Legitimate svchost runs from System32, not Temp.

Trap 2: It is a third-party application that requires investigation

Third-party apps should not impersonate system processes.

Trap 3: It is a temporary file created by Windows Update

Windows Update does not create svchost in Temp.

A
It is a legitimate Windows service host process
Why wrong: Legitimate svchost runs from System32, not Temp.
B
It is a third-party application that requires investigation
Why wrong: Third-party apps should not impersonate system processes.
C
It is likely malware disguised as a legitimate process
Malware often uses common names in non-standard locations to evade detection.
D
It is a temporary file created by Windows Update
Why wrong: Windows Update does not create svchost in Temp.

Question 17hardmultiple choice

A security analyst is reviewing host-based logs from a compromised system. The Windows Security Event Log shows multiple Event ID 4625 (failed logon) from a single source IP, but no successful logon. The network team confirms that IP is a known scanning host. What is the most likely explanation for the lack of successful logon events?

Trap 1: The logon type was interactive, which is not recorded by Event ID…

Event ID 4625 records all failed logon attempts regardless of type.

Trap 2: The attacker successfully logged in but the logs were deleted by…

While possible, the scenario indicates no successful logon, and logs are present for failures. Deletion would likely affect all logs.

Trap 3: The attacker used a pass-the-hash technique that bypasses logon…

Pass-the-hash still generates logon events, just with NTLM hash.

A
The brute-force attack did not succeed in gaining access
Failed logons without success indicate the attacker did not compromise the account.
B
The logon type was interactive, which is not recorded by Event ID 4625
Why wrong: Event ID 4625 records all failed logon attempts regardless of type.
C
The attacker successfully logged in but the logs were deleted by the attacker
Why wrong: While possible, the scenario indicates no successful logon, and logs are present for failures. Deletion would likely affect all logs.
D
The attacker used a pass-the-hash technique that bypasses logon events
Why wrong: Pass-the-hash still generates logon events, just with NTLM hash.

Question 18hardmultiple choice

An analyst is performing host-based analysis on a machine that is part of a botnet. The machine is communicating with a C2 server over HTTPS. Which host-based evidence would be most useful to identify the C2 communication?

Trap 1: Packet capture showing the unencrypted payload

HTTPS is encrypted; payload cannot be seen without decryption.

Trap 2: A memory dump of the process showing encryption keys

Memory dump can capture keys, but that is advanced analysis and not the first line of evidence.

Trap 3: Windows Event ID 5157 (Filtering Platform connection) showing the…

Event ID 5157 can show process but not the DNS resolution. Still useful, but DNS logs are more directly related to C2 identification.

A
Packet capture showing the unencrypted payload
Why wrong: HTTPS is encrypted; payload cannot be seen without decryption.
B
A memory dump of the process showing encryption keys
Why wrong: Memory dump can capture keys, but that is advanced analysis and not the first line of evidence.
C
DNS logs showing queries to the C2 domain
DNS queries often precede HTTPS connections. The domain may be unique or malicious.
D
Windows Event ID 5157 (Filtering Platform connection) showing the process ID
Why wrong: Event ID 5157 can show process but not the DNS resolution. Still useful, but DNS logs are more directly related to C2 identification.

Question 19easymultiple choice

Which Windows registry hive is most likely to contain evidence of malware persistence via a service?

Trap 1: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

This is for auto-start programs, not services.

Trap 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

This is for user-level startup, not services.

Trap 3: HKEY_LOCAL_MACHINE\SAM

SAM contains user passwords, not service information.

A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Why wrong: This is for auto-start programs, not services.
B
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
This hive stores service configurations, including the path to the executable.
C
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Why wrong: This is for user-level startup, not services.
D
HKEY_LOCAL_MACHINE\SAM
Why wrong: SAM contains user passwords, not service information.

Question 20mediummultiple choice

A host-based analysis tool reports that a file has a digital signature that is valid but from an untrusted publisher. What should the analyst interpret from this?

Trap 1: The file is definitely malicious because the publisher is untrusted

Signature integrity is valid; untrusted means not in trusted store, but could be legitimate software from a new vendor.

Trap 2: The file's signature was revoked

Not necessarily; it says valid but untrusted, not revoked.

Trap 3: The file is definitely safe because the signature is valid

A valid signature does not guarantee safety; malware can be signed.

A
The file is definitely malicious because the publisher is untrusted
Why wrong: Signature integrity is valid; untrusted means not in trusted store, but could be legitimate software from a new vendor.
B
The file's signature was revoked
Why wrong: Not necessarily; it says valid but untrusted, not revoked.
C
The file may be malicious or legitimate; further analysis is needed
The signature chain is technically valid, but the publisher is not trusted by default. Requires contextual analysis.
D
The file is definitely safe because the signature is valid
Why wrong: A valid signature does not guarantee safety; malware can be signed.