PEN-200 Antivirus Evasion Practice Question
During a PEN-200 lab, a penetration tester develops a custom C# loader that allocates memory, writes shellcode, and executes it. Windows Defender's AMSI flags the process when the shellcode buffer is passed to a scanning routine. The tester wants to prevent AMSI from inspecting the buffer at runtime without disabling Defender. Which technique should the tester apply?
⚠ Common exam trap
The trap here is assuming that encoding or obfuscating shellcode prevents AMSI from scanning it, when AMSI actually inspects the decoded buffer in memory.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the AmsiScanBuffer function's memory patching to force it to return a clean result.
AMSI scans buffers passed to functions like AmsiScanBuffer; to evade it without disabling Defender, the tester can patch AmsiScanBuffer in memory to return a benign result. This prevents the shellcode from being flagged. Encoding, CFG, or user privileges do not stop AMSI from scanning the buffer at runtime.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use the AmsiScanBuffer function's memory patching to force it to return a clean result.
Why this is correct
Patching AmsiScanBuffer in memory (e.g., by overwriting its first bytes with a return value of S_OK or a benign HRESULT) prevents AMSI from scanning the buffer, effectively bypassing detection without disabling Defender. This is a common in-memory evasion technique taught in PEN-200 for evading AMSI.
- ✗
Run the loader under a different user account with limited privileges.
Why it's wrong here
AMSI operates per-process and scans content regardless of user privileges; running as a limited user does not bypass AMSI. The scanning occurs in the context of the process, so privilege level does not prevent AMSI from inspecting the buffer.
- ✗
Base64-encode the shellcode and decode it at runtime before execution.
Why it's wrong here
Base64 encoding only obfuscates the shellcode's static representation; when decoded into memory, the shellcode is still scanned by AMSI if passed to a scanning function. AMSI operates on the decoded buffer, so encoding alone does not prevent inspection at runtime.
- ✗
Compile the loader with the /guard:cf flag to enable Control Flow Guard.
Why it's wrong here
Control Flow Guard is a security mitigation that restricts indirect calls; it does not affect AMSI scanning. Enabling it would not prevent AMSI from inspecting the shellcode buffer and could even hinder shellcode execution by enforcing valid call targets.
About these practice questions
This PEN-200 question is part of Courseiva's 285-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official OffSec exam blueprint
This PEN-200 practice question is part of Courseiva's free OffSec certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PEN-200 exam.