CAS-004 Security Operations Practice Question
A penetration tester is in the post-exploitation phase and wants to maintain access to a compromised system. Which of the following techniques is most effective for establishing persistent access while evading detection?
⚠ Common exam trap
The trap is equating 'persistence' with 'access' — CAS-005 candidates pick web shells or admin accounts because they grant access, but those are noisy and easily detected, whereas the question emphasizes evading detection, which favors scheduled tasks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Creating a scheduled task that executes a reverse shell
A scheduled task (cron on Linux, Task Scheduler on Windows) that periodically launches a reverse shell is a classic persistence mechanism that blends into normal system activity, survives reboots, and is harder to detect than a static web shell or a new admin account. It provides recurring, stealthy access without leaving obvious artifacts like a listening service or a conspicuous privileged account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Uploading a web shell to a publicly accessible directory
Why it's wrong here
A web shell in a public directory offers remote command execution but is easily found by file-integrity monitoring and web scanning, so it fails the evading-detection requirement. It is tempting because web shells are simple and survive reboots, suiting quick access where stealth is not needed.
- ✗
Creating a new local user account with administrative privileges
Why it's wrong here
A new administrative local account is conspicuous: it appears in account listings, login audits and privileged-group reviews, so it fails the evading-detection requirement. It is tempting because local admin accounts grant reliable, reboot-surviving access, which suits environments without active monitoring.
- ✗
Installing a rogue certificate authority
Why it's wrong here
Installing a rogue certificate authority does not establish persistent access; it enables man-in-the-middle attacks by allowing the attacker to sign forged certificates that clients trust. This technique is tempting because certificate authorities are critical for TLS trust chains, and compromising one can grant long-term eavesdropping capability on encrypted traffic. However, the stem requires maintaining interactive access to the compromised system, not intercepting network communications—a task typically achieved by installing a backdoor or scheduled task.
- ✓
Creating a scheduled task that executes a reverse shell
Why this is correct
A scheduled task runs the reverse shell at defined intervals or logon, surviving reboots without a persistent service or startup folder entry. This satisfies maintaining access while blending into legitimate Windows Task Scheduler activity, evading detection better than always-on listeners or new local accounts.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.