What is the best description of using Windows scheduled tasks for persistence during a pentest?

• A. They are completely invisible and leave no traces.
• B. Scheduled tasks can automate repetitive tasks silently, but they may still leave traces in system logs, making detection possible.
• C. They cannot run commands in the background.
• D. They require no user permissions and cannot be detected.

Answer: (B)

Scheduled tasks provide a legitimate way to automate actions in Windows, and in a pentest they’re commonly used to achieve persistence by scheduling your payload to run at boot, on login, or at specific times. This lets the attacker maintain access across reboots and run without an active user session, often in the background. But they are not invisible. Windows records task creation and execution in multiple logs and storage areas, so defenders can detect them by listing scheduled tasks, inspecting event logs, and reviewing the Task Scheduler metadata for unusual or unsigned executables. That combination—automation with the potential for traces—is why the best description is that scheduled tasks automate repetitive tasks silently, but may still leave traces in system logs, making detection possible.