Cisco
300-215 · Question #55
Refer to the exhibit. What does the exhibit indicate?
The correct answer is B. A UAC bypass is created by modifying user-accessible registry settings. The PowerShell snippet adds and configures the DelegateExecute value under the per‐user HKCU\Software\Classes\Folder\shell\open\command key-a known registry‐based UAC bypass technique that lets code run elevated without prompting.
Submitted by thandi_sa· Mar 6, 2026Forensics Techniques
Question
Refer to the exhibit. What does the exhibit indicate?
Exhibit
Options
- AThe new file is created under the Software\Classes disk folder.
- BA UAC bypass is created by modifying user-accessible registry settings.
- CA scheduled task named "DelegateExecute" is created.
- DThe shell software is modified via PowerShell.
How the community answered
(18 responses)- A6% (1)
- B72% (13)
- C17% (3)
- D6% (1)
Explanation
The PowerShell snippet adds and configures the DelegateExecute value under the per‐user HKCU\Software\Classes\Folder\shell\open\command key-a known registry‐based UAC bypass technique that lets code run elevated without prompting.
Topics
#UAC bypass#privilege escalation#registry modification#Windows security
Community Discussion
No community discussion yet for this question.