Question 223 of 509

Attacks and Exploits →mediumMultiple ChoiceObjective-mapped

Quick Answer

The answer is to create a malicious executable named 'MyApp.exe' and place it in C:\Program Files\. This works because the unquoted service path privilege escalation technique exploits how Windows interprets spaces in the binary path; when the service starts, the system searches for each space-delimited segment as a potential executable, first trying C:\Program.exe, then C:\Program Files\MyApp.exe, before reaching the intended C:\Program Files\MyApp\service.exe. On the CompTIA PenTest+ PT0-002 exam, this scenario tests your understanding of Windows service misconfigurations and the order of execution for unquoted paths—a common trap is assuming the service runs the final file directly, but the key is that the space in "Program Files" creates the hijack opportunity. For a memory tip, remember "space before slash, hijack the path": the unquoted space lets you insert your own executable earlier in the search order, escalating to SYSTEM.

PT0-002 Attacks and Exploits Practice Question

This PT0-002 practice question tests your understanding of attacks and exploits. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A penetration tester has gained low-privilege access on a Windows 10 machine. The tester discovers that a service runs with SYSTEM privileges and has the following binary path: C:\Program Files\MyApp\service.exe. The path is unquoted. Which exploitation technique is most likely to allow the tester to escalate privileges?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.

Question 1mediummultiple choice

Read the full NAT/PAT explanation →

A
Create a malicious executable named 'C:\Program.exe' and place it in the root of C:.
Why wrong: This could work if the path started with 'C:\Program', but the actual path is 'C:\Program Files\MyApp\service.exe'. The first space after 'C:\Program' would cause Windows to attempt to execute 'C:\Program.exe', but placing a file in the root requires write access to C:\, which is unlikely for a low-privileged user.
B
Create a malicious executable named 'MyApp.exe' and place it in C:\Program Files\.
Correct. Because the service path is unquoted, Windows will first try to execute 'C:\Program.exe', but that does not exist. It then tries 'C:\Program Files\MyApp.exe'. If the tester can write to 'C:\Program Files\', they can place a malicious 'MyApp.exe' there. When the service starts, it will run the malicious executable with SYSTEM privileges.
C
Modify the service's binary path in the registry to point to a malicious executable.
Why wrong: Modifying the service's binary path in the registry typically requires administrative privileges. Since the tester has only low-privileged access, this approach is not feasible.
D
Use SeImpersonatePrivilege to impersonate the SYSTEM account and directly modify the service.
Why wrong: SeImpersonatePrivilege allows impersonation of a token, but it does not grant the ability to modify services or write to protected directories. This privilege is more commonly used in token manipulation attacks like Juicy Potato, not for exploiting unquoted service paths.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create a malicious executable named 'MyApp.exe' and place it in C:\Program Files\.

The unquoted service binary path 'C:\Program Files\MyApp\service.exe' allows Windows to interpret spaces as separators, so it will attempt to execute 'C:\Program.exe' first, then 'C:\Program Files\MyApp.exe', and finally the intended path. By placing a malicious 'MyApp.exe' in 'C:\Program Files\', the tester exploits the space in 'Program Files' to hijack execution before the legitimate service.exe runs, achieving privilege escalation to SYSTEM.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Create a malicious executable named 'C:\Program.exe' and place it in the root of C:.
Why it's wrong here
This could work if the path started with 'C:\Program', but the actual path is 'C:\Program Files\MyApp\service.exe'. The first space after 'C:\Program' would cause Windows to attempt to execute 'C:\Program.exe', but placing a file in the root requires write access to C:\, which is unlikely for a low-privileged user.
✓
Create a malicious executable named 'MyApp.exe' and place it in C:\Program Files\.
Why this is correct
Correct. Because the service path is unquoted, Windows will first try to execute 'C:\Program.exe', but that does not exist. It then tries 'C:\Program Files\MyApp.exe'. If the tester can write to 'C:\Program Files\', they can place a malicious 'MyApp.exe' there. When the service starts, it will run the malicious executable with SYSTEM privileges.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Modify the service's binary path in the registry to point to a malicious executable.
Why it's wrong here
Modifying the service's binary path in the registry typically requires administrative privileges. Since the tester has only low-privileged access, this approach is not feasible.
✗
Use SeImpersonatePrivilege to impersonate the SYSTEM account and directly modify the service.
Why it's wrong here
SeImpersonatePrivilege allows impersonation of a token, but it does not grant the ability to modify services or write to protected directories. This privilege is more commonly used in token manipulation attacks like Juicy Potato, not for exploiting unquoted service paths.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates may assume the exploit requires placing an executable at the root (C:\Program.exe) or modifying the registry, but the correct technique exploits the space in 'Program Files' by placing the malicious binary in that directory, not at the root.

Detailed technical explanation

How to think about this question

The unquoted service path vulnerability relies on the Windows CreateProcess function, which parses the command line by splitting on spaces unless quoted. In this case, the path 'C:\Program Files\MyApp\service.exe' is interpreted as three potential executables: 'C:\Program.exe', 'C:\Program Files\MyApp.exe', and 'C:\Program Files\MyApp\service.exe'. The tester must place the malicious executable in a directory that Windows will check before the intended binary, leveraging the space in 'Program Files' to execute 'MyApp.exe' from that folder. Real-world scenarios often involve services installed by third-party software with unquoted paths, making this a common privilege escalation vector on Windows systems.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A security team runs a vulnerability scan on a web application and discovers an unpatched SQL injection flaw. The team prioritises remediation by CVSS score — critical flaws are patched within 24 hours, high within 7 days. Questions like this test whether you understand vulnerability management processes, scanning tools, and remediation prioritisation.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related PT0-002 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Planning and Scoping practice questions

Practise PT0-002 questions linked to Planning and Scoping.

Information Gathering and Vulnerability Scanning practice questions

Practise PT0-002 questions linked to Information Gathering and Vulnerability Scanning.

Attacks and Exploits practice questions

Practise PT0-002 questions linked to Attacks and Exploits.

Reporting and Communication practice questions

Practise PT0-002 questions linked to Reporting and Communication.

Tools and Code Analysis practice questions

Practise PT0-002 questions linked to Tools and Code Analysis.

PT0-002 fundamentals practice questions

Practise PT0-002 questions linked to PT0-002 fundamentals.

PT0-002 scenario practice questions

Practise PT0-002 questions linked to PT0-002 scenario.

PT0-002 troubleshooting practice questions

Practise PT0-002 questions linked to PT0-002 troubleshooting.

Practice this exam

Start a free PT0-002 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

PT0-002 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this PT0-002 question test?

Attacks and Exploits — This question tests Attacks and Exploits — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Create a malicious executable named 'MyApp.exe' and place it in C:\Program Files\. — The unquoted service binary path 'C:\Program Files\MyApp\service.exe' allows Windows to interpret spaces as separators, so it will attempt to execute 'C:\Program.exe' first, then 'C:\Program Files\MyApp.exe', and finally the intended path. By placing a malicious 'MyApp.exe' in 'C:\Program Files\', the tester exploits the space in 'Program Files' to hijack execution before the legitimate service.exe runs, achieving privilege escalation to SYSTEM.

What should I do if I get this PT0-002 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Are there clue words in this question I should notice?

Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Last reviewed: Jun 11, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This PT0-002 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-002 exam.