Chapter 3 of 5 · Cisco CCNA 200-201 CBROPS
Host-Based Analysis
Endpoint technologies, operating system components, evidence, logs and malware reports.
- 5topics
- 22 minfast track
- 20%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Endpoint Security TechnologiesLearn how host based intrusion detection, antimalware and antivirus, and host firewalls use rules, signatures and predictive AI…4 min
- 2Operating System Components: Windows and LinuxIdentify the Windows and Linux components that matter in an investigation, including processes, services, the registry, file…4 min
- 3Attribution and Types of EvidenceLearn the role of attribution in an investigation, including assets, threat actors, IoCs, IoAs and chain of custody, and the…5 min
- 4Interpreting Host, SIEM and Command Line LogsRead Windows event logs, Linux authentication logs, SIEM and SOAR records and command line output to identify what happened on a…5 min
- 5Reading Malware Analysis ReportsInterpret a sandbox or detonation chamber report, including file hashes, URLs, and the system, event and network behaviour that…4 min
About this chapter
What this chapter covers
Host-Based Analysis is about investigating what happened on a single machine.
It begins with the tools that protect and watch an endpoint. It then covers the operating system parts an analyst must recognise, and the way an investigation uses evidence and attribution.
The last two topics are practical. They show how to read logs from many sources, and how to read the report from a sandbox that has run a suspicious file.
How the topics fit together
The chapter follows an investigation from the endpoint tools, through the host, to the evidence and the report.
The first page explains the endpoint technologies and how rules, signatures and predictive AI differ. The second page names the Windows and Linux components that attackers touch, such as services, the registry and log files.
The third page covers attribution, indicators and the types of evidence, with the chain of custody that protects them. The fourth page applies this to real log lines from Windows, Linux, a SIEM and a SOAR platform.
The final page reads a malware analysis report, and turns its hashes, URLs and behaviours into indicators for the rest of the network.
Evidence handling from the third page links to the forensics topics in the policies and procedures chapter.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables, diagrams and example output.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Practise reading log lines and reports. For each one, ask who, what, when, where and what the result was.
Ready for more practice?
The full Cisco CCNA 200-201 CBROPS question bank has 754 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.