Which of the following is the reason why a penetration tester would run the chkconfig --del command at the end of an engagement? servicename

During a penetration test, testers often establish persistence by adding a malicious service to the init system using chkconfig --add. Running chkconfig --del servicename at the end of the engagement removes that service from all runlevel startup scripts, effectively eliminating the persistence and restoring the system to its pre-test state.

chkconfig --add or chkconfig servicename on would enable persistence, not --del, which does the opposite.

Reporting persistence is a documentation activity done in a written report, not accomplished by running a shell command.

Checking for existing persistence would use chkconfig --list, not --del, which is a destructive operation that removes the entry.