200-201 Host-Based Analysis Practice Question
An analyst is investigating a Windows system for signs of malware persistence. Which TWO registry locations are commonly used by malware to achieve automatic startup? (Choose two.)
⚠ Common exam trap
Cisco often tests the distinction between Run and RunOnce keys, and the trap here is that candidates mistakenly choose RunOnce options (B or C) thinking they provide persistence, when in fact they only execute a program a single time and then remove the entry.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
A is correct because the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run registry key is a standard autostart location that launches programs when the current user logs in. Malware frequently writes a value here to achieve persistence without requiring administrative privileges, as it affects only the current user's session.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Why this is correct
User-specific Run key.
- ✗
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
Why it's wrong here
RunOnce is for one-time execution, not persistent.
- ✗
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
Why it's wrong here
Same as above.
- ✓
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Why this is correct
System-wide Run key.
- ✗
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\AppInit_DLLs
Why it's wrong here
Used for DLL injection, not direct executable startup.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.