Cert Master

KT-EPS Startup persistence

Autoruns shows an unknown scheduled task calling a binary in %ProgramData%. Action?

Multiple choice — select one answer

Answer choices

  1. a. Delete only the task file so the binary remains for future malware research, without security or identity team coordination per policy.
  2. b. Reboot the PC once without collecting logs to clear persistence automatically, without security or identity team coordination per policy.
  3. c. Disable the task, quarantine the binary, and search for other hosts with same hash
  4. d. Ignore if the binary is larger than one megabyte because large files are safe

Architectural breakdown & explanation

Unknown scheduled tasks with unusual paths warrant hunt and remediation.

Correct answer(s): c. Disable the task, quarantine the binary, and search for other hosts with same hash

Exam domain: Startup persistence (20% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the KeyTrain's Key Training — Endpoint Security bank. Run a full timed practice exam with domain-weighted random questions in your browser.

Start practice exam View exam overview All certifications