CS0-003 Security Operations Practice Question
During a threat hunting exercise, an analyst creates a hypothesis that a threat actor may be using scheduled tasks for persistence. Which Windows registry key or log source should the analyst examine to confirm the hypothesis?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review the Windows Security Event Log for event ID 4698 (scheduled task creation)
Scheduled tasks are stored in the Windows Task Scheduler and can be viewed via schtasks.exe, but the registry also contains persistence mechanisms. However, scheduled tasks are not primarily stored in the registry; they are in %SystemRoot%\Tasks. Alternatively, the analyst can use the Task Scheduler API. But among the options, examining the 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule' is not standard. Actually, the correct answer is to examine the Task Scheduler logs or the tasks folder. However, the question specifies registry key or log source. The best answer is to review the Windows Security Event Log for event ID 4698 (scheduled task creation).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Check the Run registry keys (HKLM\Software\Microsoft\Windows\CurrentVersion\Run)
Why it's wrong here
Checking the Run registry keys (HKLM\Software\Microsoft\Windows\CurrentVersion\Run) is ineffective for detecting scheduled tasks. These registry keys are designed to launch programs automatically when a user logs on or the system starts, not for time-based or event-triggered executions managed by the Task Scheduler service. Scheduled tasks utilize a distinct persistence mechanism, storing their configurations in XML files and relying on the Task Scheduler service for execution, making Run keys an irrelevant location for this type of artifact.
- ✓
Review the Windows Security Event Log for event ID 4698 (scheduled task creation)
Why this is correct
Reviewing the Windows Security Event Log for event ID 4698 is the most direct and effective method to detect the creation of new scheduled tasks. This specific event ID explicitly logs when a scheduled task is registered on the system, providing crucial forensic evidence of a potential persistence mechanism established by an attacker. Analyzing these logs allows analysts to identify the task name, creator, and associated command, which are vital details for incident response.
- ✗
Examine the System event log for driver loading events
Why it's wrong here
Examining the System event log for driver loading events is not relevant for identifying scheduled task creation. The System log primarily records events related to system components, hardware, device drivers, and operating system services, such as driver installations or failures. Scheduled tasks, however, operate at a higher abstraction layer, managed by the Task Scheduler service, and do not directly involve driver-level operations or log their creation within the System event log.
- ✗
Analyze the application event log for error messages
Why it's wrong here
Analyzing the Application event log for error messages is unlikely to reveal the creation of a scheduled task. The Application log is dedicated to events generated by applications or programs, including errors, warnings, and informational messages specific to their operation. While a malicious application might log its own activities, the *creation* of a scheduled task is a system-level action that is specifically logged in the Security event log, not typically within the Application log.
Go deeper
Related to this question
Learn chapter
Threat Intelligence and Threat Hunting
Key term
Event log
An event log is a file or record that stores a chronological list of events, changes, errors, or security incidents occurring on a computer system or network.
Key term
Persistence
Persistence is the set of techniques attackers use to maintain long-term access to a compromised system even after reboots or credential changes.
About these practice questions
This CS0-004 question is part of Courseiva's 236-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.