CS0-003 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  HKLM\Software\Microsoft\Windows\CurrentVersion\AppInit_DLLs

  Why it's wrong here

  AppInit_DLLs is a machine-wide persistence mechanism that forces every user-mode process to load a specified DLL, but modern Windows versions disable it by default and require any loaded binary to be code-signed. The SecureDll flag and code-integrity policies further reduce its viability, so adversaries rarely use it today. Compared with services, Run keys, and scheduled tasks, AppInit_DLLs is not a top-three persistence vector for osquery-based triage, as those other mechanisms are far more prevalent and have dedicated, stable query tables.

• ✗

  User's Startup folder

  Why it's wrong here

  The Startup folder is a valid persistence location, because executables placed there launch at every user logon, but it is user-scoped and only runs in the logged-on user's context. A threat hunter using osquery would typically prioritize system-wide persistence mechanisms such as services, scheduled tasks, and registry Run keys, which affect multiple sessions and can provide privilege escalation. Additionally, the Startup folder requires enumerating file-system paths that may be redirected or easily overlooked, whereas the selected mechanisms have direct osquery tables and are more commonly abused in real-world intrusions.

• ✓

  HKLM\SYSTEM\CurrentControlSet\Services

  Why this is correct

  Services are a high-value persistence target because they can be set to AUTO_START, allowing an adversary to execute payloads with SYSTEM privileges at boot, before any user logs on. The osquery services table exposes fields such as name, path, start_type, and status, making it easy for hunters to spot anomalies like a non-standard executable path or a suspicious service name. Because services run independently of user sessions, survive reboots, and often run with the highest integrity level, they are one of the strongest and most frequently abused persistence techniques.

• ✓

  HKCU\Software\Microsoft\Windows\CurrentVersion\Run

  Why this is correct

  The HKCU\Software\Microsoft\Windows\CurrentVersion\Run key is among the most common autostart mechanisms, launching a program every time the user signs in and written without administrative privileges. The osquery registry table can enumerate this key and its values, allowing a hunter to identify the referenced executable path and then correlate it with file hashes or process listings. Although it runs only in the user's context and not pre-login, it is a top persistence choice for commodity malware and post-exploitation frameworks, exactly as this question indicates.

• ✓

  Scheduled tasks in Task Scheduler

  Why this is correct

  Scheduled tasks are a powerful persistence technique because they can be triggered by events like logon, startup, or an interval, and they can execute with elevated SYSTEM privileges when created by an admin. Osquery's scheduled_tasks table lists task names, actions, triggers, and run levels, enabling a hunter to quickly detect a new or modified task pointing to an unexpected binary. Attackers routinely abuse the Windows Task Scheduler to maintain persistence while blending into normal systems operations, and because these tasks can run as SYSTEM and are often hidden, they are a critical priority for any osquery-based hunt.

Go deeper

Related to this question