A penetration tester needs to complete cleanup activities from the testing lead. Which of the following should the tester do to validate that reverse shell payloads are no longer running?

The correct answer is A. Run scripts to terminate the implant on affected hosts.. To ensure that reverse shell payloads are no longer running, it is essential to actively terminate any implanted malware or scripts. Run Scripts to Terminate the Implant: This ensures that any reverse shell payloads or malicious implants are actively terminated on the affected ho

Submitted by thandi_sa· Mar 6, 2026Engagement Management

Question

Options

ARun scripts to terminate the implant on affected hosts.
BSpin down the C2 listeners.
CRestore the firewall settings of the original affected hosts.
DExit from C2 listener active sessions.

How the community answered

(23 responses)

A
91% (21)
B
4% (1)
C
4% (1)

Explanation

To ensure that reverse shell payloads are no longer running, it is essential to actively terminate any implanted malware or scripts. Run Scripts to Terminate the Implant: This ensures that any reverse shell payloads or malicious implants are actively terminated on the affected hosts. It is a direct and effective method to clean up after a penetration test.

Topics

#cleanup#post-engagement#reverse shell#implant removal

Community Discussion

No community discussion yet for this question.

Full PT0-003 Practice