GSEC Windows Services and MS Cloud Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

  Why this is correct

  Windows services are configured under HKLM\SYSTEM\CurrentControlSet\Services. Each subkey corresponds to a service and contains values such as ImagePath, Start, and ObjectName. A malicious service would create a subkey here. This is the correct location to examine for service persistence.

• ✗

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost

  Why it's wrong here

  There is no standard registry key named 'Svchost' under that path. Svchost.exe groups services, but its configuration is not stored in a dedicated registry key. Service configurations are stored under the Services key. Therefore, this location is incorrect and likely a distractor.

• ✗

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

  Why it's wrong here

  The Run key is used for programs that execute at user logon, not for services. Malicious services are not typically configured there. The analyst should look at the Services key instead. The Run key is a common persistence location for user-level malware, but it is not the correct location for service configurations.

• ✗

  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

  Why it's wrong here

  This key is for programs that run at the logon of the current user. It is not used for services, which run under the System account or other service accounts. Malicious services would not be configured here, so this is not the correct location to investigate.