PEN-200 Antivirus Evasion Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Set the registry value HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableAMSI to 1.

  Why it's wrong here

  There is no such supported policy value that disables AMSI for arbitrary processes, so writing it has no effect on scanning behavior. Fabricated registry keys are a common distractor because they look like legitimate policy paths. The scenario also requires no on-disk changes, and registry writes persist on the host, violating that constraint even if the key existed.

• ✗

  Run the PowerShell runner from a session launched with the -NoProfile and -ExecutionPolicy Bypass switches.

  Why it's wrong here

  ExecutionPolicy controls script execution rules enforced by PowerShell itself, not antimalware scanning. AMSI operates independently of execution policy and still inspects script content passed to it. Launching with those switches may allow the script to run under policy, but AMSI will still scan and may block the malicious content, so this does not address the actual failure described.

• ✓

  Patch the AmsiScanBuffer function in memory by overwriting its first bytes with a return value that indicates a clean scan.

  Why this is correct

  AMSI resolves AmsiScanBuffer from amsi.dll inside each process. Overwriting the function's prologue in the current process's memory so it returns a benign result causes subsequent scans to report no detection, and this works within the user's own process without admin rights or disk changes. It matches the requirement to disable scanning for the current process only and leaves files untouched.

• ✗

  Delete the amsi.dll file from C:\Windows\System32 and reboot the target host.

  Why it's wrong here

  Deleting a system DLL from System32 requires administrative privileges and would break other components that depend on AMSI, likely destabilizing the system. It also modifies the host on disk, which the scenario explicitly rules out. Even if it succeeded, a reboot would reload protected system files under Windows File Protection, restoring the DLL and leaving the technique ineffective for the engagement.