Unauthorized changes such as new autorun keys or modified system binaries are indicators of malware persistence in which data areas?

• A. File System and Registry changes
• B. Network ACL configurations
• C. User email aliases
• D. Printer queue settings

Answer: (A)

The main idea here is that malware maintains persistence by altering data areas that the operating system loads at startup. Unauthorized changes like new autorun keys and modifications to system binaries are classic signs because they force code to run automatically when the machine boots or a user logs in. In Windows, autorun behavior is driven by entries in the Registry (such as Run keys), so adding or changing those keys is a direct way a threat ensures it starts again after reboots. Likewise, tampering with system binaries can replace or hook legitimate files, making the malicious code execute as part of normal system startup or during routine operations.

These persistence techniques rely on the File System and the Registry—the data areas that the OS reads during boot and login. That’s why changes in these areas are strong indicators of malware persistence.

The other options don’t fit because they involve network access controls, email routing, or printer configuration. Those areas don’t control how software persists across reboots, so they’re not the typical data areas malware uses for persistence.