CAS-004 Security Operations Practice Question
During a red team exercise, the team gains access to a workstation and needs to maintain persistence. They modify a registry run key to execute a payload. However, the organization uses EDR that monitors registry changes. Which technique could the red team use to avoid detection?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a LOLBin to execute the payload via a scheduled task
Living-off-the-land binaries (LOLBins) use legitimate system tools to execute code, which can blend in with normal activity and avoid EDR detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete the registry key after execution
Why it's wrong here
Deletion may still be logged and detected.
- ✗
Change the registry key to a less suspicious name
Why it's wrong here
EDR can still detect the modification event.
- ✗
Encrypt the registry key value
Why it's wrong here
Encryption does not prevent detection of the registry modification.
- ✓
Use a LOLBin to execute the payload via a scheduled task
Why this is correct
LOLBins are less likely to be flagged as malicious by EDR.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.