nerdexam
CompTIA

PT0-001 · Question #206

Which of the following can be used for post-exploitation activities?

The correct answer is D. PowerShell. Post-exploitation refers to activities performed after initial compromise, and PowerShell is the most widely used native tool for this purpose due to its deep OS integration.

Post-exploitation and lateral movement

Question

Which of the following can be used for post-exploitation activities?

Options

  • AWinDbg
  • BIDA
  • CMaltego
  • DPowerShell

How the community answered

(30 responses)
  • B
    3% (1)
  • C
    7% (2)
  • D
    90% (27)

Why each option

Post-exploitation refers to activities performed after initial compromise, and PowerShell is the most widely used native tool for this purpose due to its deep OS integration.

AWinDbg

WinDbg is a kernel and user-mode debugger used for software development and crash dump analysis, not for post-exploitation activities.

BIDA

IDA is an interactive disassembler used for reverse engineering and malware analysis, not for conducting actions on a compromised host.

CMaltego

Maltego is an OSINT and reconnaissance tool used to map entity relationships during pre-exploitation phases, not post-exploitation.

DPowerShellCorrect

PowerShell is a native Windows scripting environment extensively used in post-exploitation for privilege escalation, lateral movement, persistence, and data exfiltration. Frameworks like PowerSploit and Empire are PowerShell-based and purpose-built for post-compromise operations. Its deep integration with Windows APIs and .NET makes it ideal for operating stealthily within a compromised environment.

Concept tested: Post-exploitation tools and PowerShell offensive use

Source: https://attack.mitre.org/techniques/T1059/001/

Topics

#post-exploitation#PowerShell#tooling#scripting

Community Discussion

No community discussion yet for this question.

Full PT0-001 Practice