200-201 Host-Based Analysis Practice Question
Which Windows artifact stores evidence of file execution, including the path and run count, and is located in C:\Windows\Prefetch?
⚠ Common exam trap
200-201 often tests artifact-to-location mapping — candidates confuse Registry execution artifacts (Amcache, ShimCache) with Prefetch, forgetting that Prefetch specifically lives in C:\Windows\Prefetch and stores run counts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Prefetch files
Windows Prefetch files, stored in C:\Windows\Prefetch with a .pf extension, record evidence of program execution including the executable path, run count, and timestamps of recent executions. Forensic analysts use them to prove that a binary ran on a system and how many times. This directly matches the artifact described in the question.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Windows Event Logs
Why it's wrong here
Windows Event Logs record process creation via Security event 4688 or Sysmon event 1, but they do not reside in C:\Windows\Prefetch and carry no run count. They are tempting because they are a primary execution-evidence source. Prefetch .pf files provide the path and run count.
- ✗
Registry hives
Why it's wrong here
Registry hives hold configuration, user activity and some execution evidence such as ShimCache or AmCache, but not the Prefetch run count or path. They are tempting because they are a rich forensic source. The Prefetch directory itself stores the .pf files with path and run count.
- ✗
Scheduled tasks
Why it's wrong here
Scheduled tasks record configured jobs and their triggers, not evidence of execution with run counts. They are tempting because task history can show a program ran, but that data lives in the Task Scheduler operational log. Prefetch .pf files in C:\Windows\Prefetch hold the path and run count.
- ✓
Prefetch files
Why this is correct
Prefetch files, stored in C:\Windows\Prefetch with a .pf extension, record executable name, file path, run count and last-run timestamps. This directly satisfies the stem's requirement for an artifact evidencing file execution with path and run count.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.