200-201 Host-Based Analysis Practice Question
Which Windows Prefetch file extension indicates that a program has been executed on the system?
⚠ Common exam trap
200-201 often tests the confusion between Prefetch (.pf) and other forensic artifacts like Event Logs (.evtx) — candidates may pick .evtx because it records events, but .pf specifically indicates program execution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
.pf
Prefetch files with the .pf extension are created by Windows when a program is executed, storing metadata about the executable's loading and execution. The presence of a .pf file in C:\Windows\Prefetch is a strong indicator that the program ran on the system. This makes .pf the correct extension for indicating program execution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
.evtx
Why it's wrong here
Prefetch execution evidence is stored in .pf files, not .evtx; .evtx is the Windows Event Log format, recording system and security events. It is tempting because event logs do evidence process activity, but .evtx would be correct when correlating logged event IDs rather than reading Prefetch run metadata.
- ✓
.pf
Why this is correct
Windows writes a .pf Prefetch file into C:\Windows\Prefetch each time an executable launches, recording the binary name, run count and timestamps. Its presence therefore proves execution, unlike .lnk shortcuts or registry keys, which merely evidence access or configuration.
- ✗
.tmp
Why it's wrong here
Prefetch execution evidence is stored in .pf files, not .tmp; temporary files hold no execution metadata. It is tempting because .tmp files do appear in Prefetch-adjacent directories, but they are transient working data, so .tmp would only be relevant when examining scratch files rather than proving program execution.
- ✗
.log
Why it's wrong here
Prefetch execution evidence is stored in .pf files, not .log; log files record events, not per-program run counts. It is tempting because Prefetch directories can contain logging artefacts, but .log would be the correct focus when tracing application or service event records rather than confirming execution.
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.