CS0-003 Security Operations Practice Question
Which of the following is a persistence mechanism that involves modifying the Windows Registry to execute a program when a user logs in?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run key
The 'Run' registry key is commonly used to launch programs automatically at user logon, making it a persistence mechanism.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Scheduled Task
Why it's wrong here
Scheduled tasks are indeed a common persistence mechanism, allowing programs or scripts to execute at specific times or in response to certain events. However, the primary configuration and storage for scheduled tasks are typically found in the Task Scheduler service's database and associated XML files within the file system, not directly as a simple Registry modification that triggers execution upon user logon. Therefore, it doesn't fit the specific "Registry modification" context implied by the question's focus on logon execution via a Registry key.
- ✓
Run key
Why this is correct
The "Run" and "RunOnce" Registry keys are classic and highly effective persistence mechanisms. Entries added to `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` or `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` instruct Windows to automatically launch specified programs or scripts every time a user logs on. This direct Registry modification ensures the malicious payload executes without requiring user interaction, making it a prime target for attackers seeking to maintain access.
- ✗
Service
Why it's wrong here
Windows services are background processes designed to run independently of a logged-on user, often starting at system boot rather than specifically at user logon. While services are configured via the Registry (specifically under `HKLM\SYSTEM\CurrentControlSet\Services`), their startup mechanism is distinct from "Run" keys. Services are managed by the Service Control Manager and execute before or during the logon process, not specifically *at* user logon via the "Run" key mechanism.
- ✗
Startup folder
Why it's wrong here
The Startup folder is a user-friendly persistence mechanism where shortcuts or executable files placed within `C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup` (or its All Users equivalent) will automatically execute when the respective user logs on. However, this method relies on placing files in a specific file system directory, not on a direct modification to a Registry key to achieve execution. Thus, it does not involve a Registry modification in the manner the question implies.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CS0-004 question from scratch — 236 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.