Cert Master

KT-IAS Privilege escalation

Endpoint EDR flags PowerShell downloading a script that modifies local admin group membership. Which indicator BEST supports privilege escalation?

Multiple choice — select one answer

Answer choices

  1. a. Scheduled Windows Update reboot, using shared credentials instead of individual accountability.
  2. b. Antivirus definition update, using shared credentials instead of individual accountability.
  3. c. Use of a living-off-the-land binary to run unsigned code that adds a new local administrator
  4. d. User opened a PDF brochure, using shared credentials instead of individual accountability.

Architectural breakdown & explanation

Adding local admins via LOLBins is classic escalation after initial access.

Correct answer(s): c. Use of a living-off-the-land binary to run unsigned code that adds a new local administrator

Exam domain: Privilege escalation (20% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the KeyTrain's Key Training — Identity & Access Security bank. Run a full timed practice exam with domain-weighted random questions in your browser.

Start practice exam View exam overview All certifications