Question

During the cleanup phase of an authorized internal penetration test, you must restore a compromised Windows Server 2019 host to its pre-test state. Earlier in the engagement, you uploaded a custom credential-dumping tool to C:\Windows\Temp, created a local service named 'SysUpdate' for persistence, and modified a registry Run key. The client's SOW explicitly requires that all testing artifacts be removed and that any actions taken be documented for the final report. Which approach BEST satisfies the cleanup requirements for this engagement?

Accepted Answer

Delete the uploaded tool, remove the 'SysUpdate' service and the registry Run key, then document each removed artifact with timestamps in your engagement notes.

Answer

Run wevtutil to clear the Security, System, and Application event logs so no trace of the testing activity remains on the host.

Answer

Leave the persistence mechanisms in place so the client's blue team can practice detecting and removing them during a follow-up exercise.

Answer

Reformat and reimage the server from the client's standard baseline to guarantee that every artifact is destroyed.