PEN-200 Antivirus Evasion Practice Question
An analyst is attempting to execute a custom C2 stager on a Windows 10 workstation with active Windows Defender. They decide to use a PowerShell one-liner that downloads a script from a remote server and executes it directly using the Invoke-Expression (IEX) cmdlet. Why is this method generally more effective than downloading an .exe file to the Desktop?
⚠ Common exam trap
Candidates frequently focus on file-based obfuscation, ignoring that simply writing a suspicious .exe to disk triggers immediate signature scanning, whereas memory-only execution bypasses this specific detection layer entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Memory-only execution avoids the file-on-disk signature scanning process.
In-memory execution avoids the creation of files on the physical disk, which is where most traditional antivirus solutions perform their primary signature-based scanning. By keeping the malicious payload within the volatile memory of the PowerShell process, the attacker minimizes the forensic footprint and reduces the likelihood of triggering alerts associated with suspicious file creation or modification events on the local file system.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It bypasses the Antimalware Scan Interface (AMSI) entirely by default.
Why it's wrong here
Modern versions of PowerShell automatically integrate with the Antimalware Scan Interface to scan script contents before execution. Even if the script is loaded directly into memory without touching the disk, AMSI will still intercept the code and send it to the resident antivirus engine for evaluation, requiring additional obfuscation to successfully bypass detection.
- ✓
Memory-only execution avoids the file-on-disk signature scanning process.
Why this is correct
Antivirus software heavily relies on scanning new files created on the hard drive against a database of known malware signatures. By executing code directly in memory using Invoke-Expression, the payload never triggers the file system write hooks that would normally prompt an immediate scan, allowing the code to run if it can evade behavioral analysis.
- ✗
PowerShell scripts are automatically trusted by the Windows integrity system.
Why it's wrong here
Windows does not inherently trust PowerShell scripts simply because they are part of the operating system's management environment. Execution policies and integrated security features like Constrained Language Mode and AMSI are specifically designed to restrict or monitor script activity, ensuring that even native tools are subject to scrutiny when executing potentially harmful commands.
- ✗
The method uses the System.Net.WebClient class which encrypts the payload.
Why it's wrong here
The WebClient class is used for retrieving data over network protocols like HTTP or HTTPS, but it does not provide automatic encryption for the payload itself. While HTTPS provides transport layer security, the payload remains in its original form once downloaded into memory, meaning the antivirus can still inspect the plaintext script unless the attacker manually implements encryption.
About these practice questions
One of 285 original PEN-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official OffSec exam blueprint
This PEN-200 practice question is part of Courseiva's free OffSec certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PEN-200 exam.