A penetration tester uses a reverse shell to maintain connectivity to a target network. During the final phase of the exercise, the penetration tester removes the reverse shell. Which of the…

The correct answer is A. Removing persistence mechanisms. A reverse shell that is left on a target to maintain access is a form of persistence/backdoor. The action described -- removing the reverse shell at the end of the engagement -- is specifically the removal of a persistence mechanism. Post-engagement cleanup requires removal of…

Submitted by ashley.k· Mar 6, 2026Engagement management

Question

A penetration tester uses a reverse shell to maintain connectivity to a target network. During the final phase of the exercise, the penetration tester removes the reverse shell. Which of the following is an example of these activities?

Options

ARemoving persistence mechanisms
BUninstalling tools
CPreserving artifacts
DReverting configuration changes

How the community answered

(17 responses)

A
88% (15)
B
6% (1)
D
6% (1)

Explanation

A reverse shell that is left on a target to maintain access is a form of persistence/backdoor. The action described -- removing the reverse shell at the end of the engagement -- is specifically the removal of a persistence mechanism. Post-engagement cleanup requires removal of any artifacts that provide continued access (web shells, scheduled tasks, reverse shells, cron jobs, created accounts, etc.) so the environment is returned to its pre-test state and to prevent later

Topics

#persistence mechanisms#reverse shell#post-engagement cleanup#ethical hacking

Community Discussion

No community discussion yet for this question.

Full PT0-003 Practice