CS0-003 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Scheduled tasks in the Task Scheduler

  Why this is correct

  Scheduled tasks allow the operating system to launch specified commands or executables on triggers such as system startup, user logon, or defined intervals. Attackers frequently create scheduled tasks that re-download or re-execute malicious payloads, and these tasks persist across reboots by being stored in the Task Scheduler database. Osquery can enumerate them through the scheduled_tasks table, revealing the task name, path, and schedule, which helps identify malicious creations with autorun capabilities.

• ✗

  Windows Event Logs for login events

  Why it's wrong here

  Windows Event Logs for login events, such as Security Event ID 4624/4625, capture authentication attempts against local or domain accounts. While these records are helpful for detecting brute-force attacks or unauthorized access, they are passive log files that do not execute code or automatically start after a reboot. Persistence requires an active mechanism that triggers at startup or logon, whereas event logs are merely an audit trail of activities that have already occurred.

• ✗

  Network connections from the endpoint

  Why it's wrong here

  Network connections from the endpoint represent active or recently established TCP/UDP sessions to remote IPs and ports. Observing such connections can indicate malware beaconing to a command-and-control server, but the connections are ephemeral and rely on the malware process already being resident in memory. A network link alone does not re-launch or maintain a foothold after a system reboot; therefore, it is a behavioral indicator rather than a persistence mechanism.

• ✓

  Registry key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

  Why this is correct

  The registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run is one of the autostart locations that Windows checks each time a user logs on. Malware commonly adds a malicious executable path to a value under this key so that the payload runs with the user's privileges automatically. Osquery's registry table can query this exact key, allowing analysts to spot suspicious entries such as Base64-encoded commands or executables stored in temporary directories.

• ✓

  Services listed in the Service Control Manager

  Why this is correct

  Services registered in the Service Control Manager (SCM) with a start type of SERVICE_AUTO_START are launched by the Windows Service Control Manager at every system boot, often with SYSTEM or powerful privileges. Attackers install malicious services that point to a binary on disk, ensuring code execution starts before user logon, which is a classic high-impact persistence technique. The osquery services table exposes the service name, binary path, and start_type, enabling prompt identification of suspicious services.

Go deeper

Related to this question