GCIH Question #708: Real Exam Question with Answer & Explanation

Sign in or unlock GCIH to reveal the answer and full explanation for question #708. The question stem and answer options stay visible for context.

Malware Analysis & Advanced Persistent Threats

Question

An administrator is inspecting a machine that starts more slowly than it used to. Which key under HKLM\Software\Microsoft\Windows\ should be examined to determine if malware is executing at startup?

Options

ACurrentVersion\Run\Micromedia
BCurrentVersion\ShellCompatibility\Applications\
CCurrentVersion\Startup
DCurrentVersion\RunOnce

Unlock GCIH to see the answer

You've previewed enough free GCIH questions. Unlock GCIH for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.

Unlock GCIH - $49.99 / 30 days Sign in

Topics

#Windows registry#startup persistence#malware detection#HKLM

Full GCIH Practice