CHFI OS and Network Forensics Practice Question
A forensic analyst is investigating a Windows system for persistence mechanisms. Which TWO registry locations are commonly used by malware to achieve auto-start? (Select TWO.)
⚠ Common exam trap
In the CHFI exam, the trap here is that candidates may confuse the Run keys with other persistence locations like the Services key (Option A) or Winlogon (Option C), but the question specifically asks for the two most common auto-start registry locations, which are the HKLM and HKCU Run keys.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
The HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key is a standard auto-start location where malware can add entries to execute programs when a user logs in. This key is commonly abused because it does not require administrative privileges to modify, making it a frequent persistence mechanism for user-level malware.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
HKLM\SYSTEM\CurrentControlSet\Services
Why it's wrong here
Services key is used for service installations, not typical Run keys.
- ✗
HKLM\SAM\SAM
Why it's wrong here
SAM hive stores user account info, not autorun.
- ✗
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Why it's wrong here
Winlogon key can be used for persistence but is less common; the question asks for 'commonly used', Run keys are more typical.
- ✓
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Why this is correct
This is the Run key for the current user.
- ✓
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Why this is correct
This is a standard Run key for all users.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CHFI
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A forensic analyst reviews a Windows system for signs of malware persistence. Which TWO registry locations are commonly used to achieve persistence via auto-start programs?
easy- A.HKLM\SAM\SAM\Domains\Account\Users
- B.HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
- ✓ C.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- D.HKLM\SYSTEM\CurrentControlSet\Services
- ✓ E.HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Why C: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKCU\Software\Microsoft\Windows\CurrentVersion\Run are standard auto-start locations for all users and current user respectively. RunOnce keys execute once and are also used. But the most common are Run keys.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.