During an assessment, a penetration tester gains access to one of the internal hosts.

The command creates a scheduled task that executes a reverse shell payload at logon, ensuring persistence.

Option A (Enumerate tasks) ❌: This command creates a task, not lists tasks (schtasks /query is used for enumeration).

Option B (Establish persistence) ✅: Correct.

The attacker ensures a reverse shell opens every time a user logs in.

Option C (Deactivate Windows Update) ❌: The task is named "Windows Update" but does not disable updates.

Option D (Create a Windows Update binary) ❌: This executes a reverse shell, not a system update.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – Windows Persistence Techniques