A security team is designing a logging strategy for a high-security Windows environment. They want to detect an attacker who clears event logs, but they also want to minimize the risk of an attacker disabling the logging service. Which approach best balances these requirements?

Forward all critical event logs to a centralized SIEM using WinRM, and restrict access to the event log service

Enable Windows Event Log and configure it to overwrite events as needed, with a large log size

Use `auditpol` to set auditing to 'No auditing' to reduce log volume

Disable the Windows Event Log service to prevent attackers from clearing logs

A security team wants to improve the detection of unauthorized access attempts on a Windows server. They want to ensure that failed login attempts are logged and that the logs are protected from tampering. Which configuration is most effective?

Enable auditing of account management and set the Security log to 'Overwrite events as needed'

Enable auditing of logon events and set the Security log to 'Do not overwrite events'

Set the Security log to a small size to force rotation

Disable auditing of logon events to reduce log volume

A security administrator is trying to detect a sophisticated rootkit on a Windows server. The rootkit is known to hide processes, files, and registry keys from standard system tools. The administrator has access to the server and can run tools, but the rootkit is designed to evade signature-based detection. Which detection technique is most likely to succeed?

Use the 'tasklist' command to list all running processes

Use a rootkit detection tool that compares system calls and kernel data structures against known-good values

Check the server's event logs for unusual entries

Run a full antivirus scan with the latest signatures

An attacker has gained access to a Linux server and wants to hide the fact that a specific command was run at 03:00. The attacker has root privileges. Which action would best hide the command execution from future log review?

Change the system clock back to before the command was executed

Edit the log files to remove the entry and adjust the timestamps of surrounding entries

Delete the entire log file and recreate it with a different name

Use `touch` to change the file modification time of the log

What is the goal of anti-forensics techniques?

To improve the accuracy of forensic evidence collection

To hinder or mislead forensic investigations by destroying, hiding, or altering evidence

To automate the process of analyzing digital evidence

To ensure that all evidence is preserved for legal proceedings

EC-CouncilCertified Ethical Hacker

Domain 3Objective 6

Covering Tracks CEH Practice Questions (Page 3)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

10concepts

Questions 11–15

11expert · hard
A security team is designing a logging strategy for a high-security Windows environment. They want to detect an attacker who clears event logs, but they also want to minimize the risk of an attacker disabling the logging service. Which approach best balances these requirements?
Select an answer first
12application · medium
A security team wants to improve the detection of unauthorized access attempts on a Windows server. They want to ensure that failed login attempts are logged and that the logs are protected from tampering. Which configuration is most effective?
Select an answer first
13expert · hard
A security administrator is trying to detect a sophisticated rootkit on a Windows server. The rootkit is known to hide processes, files, and registry keys from standard system tools. The administrator has access to the server and can run tools, but the rootkit is designed to evade signature-based detection. Which detection technique is most likely to succeed?
Select an answer first
14application · medium
An attacker has gained access to a Linux server and wants to hide the fact that a specific command was run at 03:00. The attacker has root privileges. Which action would best hide the command execution from future log review?
Select an answer first
15foundation · easy
What is the goal of anti-forensics techniques?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.