A penetration tester has completed post-exploitation activities on a Windows workstation and wants to remove artifacts to minimize detection. Which action is the most appropriate for removing artifacts?

Delete the uploaded payload files and clear the Windows Event Logs.

Use a file shredder to overwrite the payload files but do not clear event logs.

Disable the Windows Event Log service and leave the payload files.

Rename the uploaded payload files and leave the event logs intact.

Which Windows command is used to clear the Security event log?

del C:\Windows\System32\Logs\Security.evtx

A penetration tester has compromised a Windows domain controller and wants to establish persistence that survives reboots and is not easily detected by the client's security operations center (SOC). The SOC monitors for new services, scheduled tasks, and registry Run keys. The tester has SYSTEM privileges. Which persistence mechanism is the most appropriate for this scenario?

Add a registry Run key under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.

Create a new service named 'WindowsUpdateSvc' that runs the payload.

Create a scheduled task that runs at system startup and executes a PowerShell reverse shell.

Modify the 'ImagePath' of an existing, rarely used service (e.g., 'Fax') to point to the payload.

CompTIAPenTest+

Domain 5Objective 1

Post-Exploitation Activities PT0-003 Practice Questions (Page 4)

Part of the Post-exploitation and lateral movement domain, which accounts for 14% of the PT0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~9–15 in this domain), expect 5–8 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

12concepts

14%of the exam

Questions 16–20

16application · medium
A penetration tester has completed post-exploitation activities on a Windows workstation and wants to remove artifacts to minimize detection. Which action is the most appropriate for removing artifacts?
Select an answer first
17foundation · easy
Which Windows service startup type ensures that a service starts automatically when the system boots?
Select an answer first
18foundation · easy
Which Windows command is used to clear the Security event log?
Select an answer first
19expert · medium
A penetration tester has compromised a Windows domain controller and wants to establish persistence that survives reboots and is not easily detected by the client's security operations center (SOC). The SOC monitors for new services, scheduled tasks, and registry Run keys. The tester has SYSTEM privileges. Which persistence mechanism is the most appropriate for this scenario?
Select an answer first
20foundation · easy
Which protocol is used by Remote Desktop Protocol (RDP) to provide remote graphical access to Windows systems?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PT0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “PT0-003” is a trademark of its owner, used for identification only.

Post-Exploitation Activities PT0-003 Practice Questions (Page 4)

Questions 16–20

A penetration tester has completed post-exploitation activities on a Windows workstation and wants to remove artifacts to minimize detection. Which action is the most appropriate for removing artifacts?

Which Windows service startup type ensures that a service starts automatically when the system boots?

Which Windows command is used to clear the Security event log?

Which protocol is used by Remote Desktop Protocol (RDP) to provide remote graphical access to Windows systems?

Keep studying — Post-exploitation and lateral movement