Covering Tracks CEH Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Why do attackers often clear or modify logs as part of covering their tracks?

   • ATo hide the evidence of their actions and avoid triggering alerts or forensic investigations
   • BTo comply with security policies that require periodic log rotation
   • CTo improve the performance of the system by freeing up disk space
   • DTo prevent the system from recording any new events
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security administrator wants to ensure that if an attacker compromises a Windows server, the attacker cannot easily disable auditing to cover their tracks. Which configuration would be most effective?

   • ADisable the Windows Event Log service to prevent log tampering
   • BSet the audit policy to log successful and failed attempts for critical event categories
   • CConfigure Windows Event Forwarding to send logs to a centralized SIEM in real time
   • DSet the log file size to maximum to store more events
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team is responding to a suspected kernel-mode rootkit on a critical Windows server. They need to confirm the rootkit's presence without taking the server offline, and they have limited time. Which approach would provide the most reliable evidence while minimizing disruption?

   • ACheck the Windows Event Log for kernel errors
   • BReboot the server and boot from a trusted forensic CD to examine the disk
   • CRun a memory forensics tool to analyze the kernel for hooks and anomalies
   • DPerform a full antivirus scan with the latest signatures
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   After compromising a Linux server, an attacker needs to hide a failed login attempt that occurred at 03:15 from the /var/log/auth.log file. The attacker wants to make the log appear normal and avoid detection by a system administrator who reviews logs daily. Which technique is most effective for this purpose?

   • AChange the system date to before the attack and then run a dummy command to generate a new log entry
   • BDelete the entire auth.log file and recreate it with touch
   • CEdit the log file with a text editor to remove the specific line and adjust timestamps
   • DUse the 'rm' command to delete the log file and then reboot the system
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An attacker has compromised a Windows file server and wants to hide a small executable tool from casual directory listing while keeping it on the same NTFS volume. The attacker also wants the file to survive a simple `dir` command. Which technique would best achieve this?

   • ARename the executable to a system filename and place it in the Windows folder
   • BStore the executable in an NTFS Alternate Data Stream attached to a legitimate file
   • CCompress the executable and change its extension to .txt
   • DSet the file attribute to 'hidden' and rely on the default folder options
   Reveal Solution Discussion Select an answer first