CHFI Persistence mechanism Practice Question
Which FOUR of the following are persistence mechanisms that can be used on Linux systems?
⚠ Common exam trap
The trap is selecting Prefetch files (A), which are often associated with persistence on Windows but do not apply to Linux. All other options are valid Linux persistence mechanisms.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSH authorized keys
Persistence mechanisms on Linux include SSH authorized keys (B), which allow an attacker to maintain remote access by adding their public key to the target user's authorized_keys file; startup scripts in /etc/init.d (C), which execute at boot; cron jobs (D), which run scheduled tasks; and modifications to /etc/passwd (E) to create persistent user accounts. Prefetch files (A) are Windows-specific and not a Linux persistence mechanism.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Prefetch files
Why it's wrong here
Prefetch files (.pf) are a Windows-specific forensic artifact that records application load data to speed up subsequent launches; they are not executable and do not trigger any action at startup, login, or scheduled times. On Linux systems, the equivalent of prefetch does not exist in the same form, and even on Windows they are not considered a persistence mechanism. Therefore, they are inapplicable to this Linux-focused persistence question.
- ✓
SSH authorized keys
Why this is correct
SSH authorized keys are a persistence mechanism because they enable an attacker to retain remote access without needing to re-exploit the system each time; by placing a public key in a user's ~/.ssh/authorized_keys file, the attacker can authenticate over SSH indefinitely, even if the user's password is changed. While they do not autonomously execute commands like cron or init scripts, the ongoing availability of a credentialed login channel is a recognized persistence technique in intrusion activity and should be examined in a forensic investigation.
- ✓
Startup scripts in /etc/init.d
Why this is correct
Startup scripts in /etc/init.d are executed by SysV init at system boot when services are started. An attacker who plants a script there gains automatic code execution with root privileges every time the machine boots, making it a classic and highly persistent execution mechanism. Since these scripts run as root before the normal user session, they are a common target for malware on legacy Linux distributions and need to be scrutinized during incident response.
- ✓
Cron jobs
Why this is correct
Cron jobs are scheduled tasks defined in crontabs, such as /etc/cron.d or a user's own crontab, that run commands at specified times or intervals. Because the cron daemon launches at boot and processes these entries, a malicious cron job will execute repeatedly with the privilege of its owner, thereby maintaining persistence independent of system reboots. They are attractive to attackers because they can achieve regular, quiet execution without modifying startup files.
- ✓
Modifications to /etc/passwd to add new users
Why this is correct
Adding a new user to /etc/passwd creates a persistent login account that survives reboots and can be accessed locally or over SSH. Attackers often give the new user UID 0 (root) so the account possesses full superuser privileges, effectively installing a permanent backdoor credential. Unlike memory-only payloads or one-time exploits, this account remains on disk and available until explicitly removed, making it a strong persistence mechanism from an access standpoint.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.