CompTIA PenTest+ (PT0-003) — Question 114

A penetration tester needs to complete cleanup activities from the testing lead. Which of the following should the tester do to ensure that reverse shell payloads are no longer running?

Answer options

• A. Run scripts to terminate the implant on affected hosts.
• B. Spin down the C2 listeners.
• C. Restore the firewall settings of the original affected hosts.
• D. Exit from C2 listener active sessions.

Correct answer: A

Explanation

The correct answer is A because running scripts to terminate the implant directly stops the reverse shell payloads on the affected hosts. Options B and D focus on the command and control infrastructure rather than the payloads themselves, while C addresses firewall settings, which does not directly affect the running reverse shells.