200-201 Host-Based Analysis Practice Question
An analyst is investigating a Windows system for signs of malware persistence. Which registry key is commonly used by malware to run automatically at user logon?
⚠ Common exam trap
200-201 often tests the distinction between persistence keys (Run, RunOnce) and forensic artifacts (UserAssist, Services) — candidates may pick UserAssist because it sounds like it tracks user activity, but it does not provide autostart persistence.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a per-user registry key that specifies programs to run automatically when the user logs on. Malware commonly uses this key for persistence because it executes in the user's context without requiring administrative privileges. This makes it a primary target for autostart persistence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Why this is correct
HKCU\Software\Microsoft\Windows\CurrentVersion\Run loads programs automatically at user logon, satisfying the persistence requirement. Because it resides in the per-user hive, malware needs no administrative rights to write there, making it a favoured autostart location. HKLM's equivalent requires elevation, so HKCU is the common low-privilege choice.
- ✗
HKLM\SYSTEM\CurrentControlSet\Services
Why it's wrong here
The Services key configures Windows services, which start at system boot under the service control manager, not at user logon. It is tempting because service-based persistence is common, and it would be the correct answer if the question asked about boot-time persistence or SYSTEM-level execution rather than logon.
- ✗
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall
Why it's wrong here
The Uninstall key lists installed programs for Add/Remove Programs; it holds no autostart mechanism, so nothing there executes at logon. It is tempting because malware often writes entries there to appear legitimate or to survive removal, and it would be the answer if the question asked where installed software is enumerated.
- ✗
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
Why it's wrong here
UserAssist records program execution counts and timestamps for forensic reconstruction, not autostart configuration, so it does not launch anything at logon. It is tempting because investigators routinely examine it to evidence what a user ran, and it would be the answer if the question asked how to prove a program executed.
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.