A red team operator has gained initial access to a corporate network and needs to maintain persistence for a long-term engagement. The operator has local administrator privileges on a single workstation but wants to avoid detection by the security operations center (SOC), which monitors for unusual logins and log clearing activities. Which approach best balances persistence and stealth?

Use a scheduled task to re-establish access every hour, but do not clear any logs

Disable Windows Defender and other security tools to avoid detection

Install a user-mode rootkit to hide the malicious process and selectively delete only the log entries related to the initial access

Create a new local user account and add it to the Administrators group

A security analyst is investigating a server that is behaving abnormally but no suspicious processes are visible in Task Manager, and file system audits show no unexpected files. The analyst suspects a rootkit is hiding the malicious activity. Which type of rootkit is most likely responsible for hiding processes and files from standard system tools?

Bootkit that replaces the boot loader to load before the operating system

Firmware rootkit that resides in the BIOS or UEFI

Hypervisor rootkit that runs beneath the operating system as a virtual machine monitor

User-mode rootkit that intercepts API calls to hide processes and files

A security team is investigating a server that has been compromised. They suspect a rootkit is hiding malicious processes, but standard tools like Task Manager and 'ps' show no anomalies. Which detection method is most likely to uncover the rootkit?

Run a full antivirus scan with updated signatures

Check the server's event logs for unusual entries

Use the 'netstat' command to look for suspicious network connections

Boot the server from a trusted live CD and compare the filesystem and registry against known-good baselines

A security analyst is investigating a suspected data exfiltration where an employee emailed a series of innocuous-looking JPEG images to a personal account. The analyst suspects that sensitive data may be hidden inside the images. Which technique would the analyst use to confirm this suspicion?

Check the file hashes against a known malware database

Review the email server logs for the attachment sizes

Open the images in a hex editor and look for readable text strings

Run a steganography detection tool to analyze the images for hidden payloads

Which Windows command is used to clear the Security event log?

del C:\Windows\System32\winevt\Logs\Security.evtx

EC-CouncilCertified Ethical Hacker

Domain 3Objective 6

Covering Tracks CEH Practice Questions (Page 4)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

10concepts

Questions 16–20

16expert · hard
A red team operator has gained initial access to a corporate network and needs to maintain persistence for a long-term engagement. The operator has local administrator privileges on a single workstation but wants to avoid detection by the security operations center (SOC), which monitors for unusual logins and log clearing activities. Which approach best balances persistence and stealth?
Select an answer first
17application · medium
A security analyst is investigating a server that is behaving abnormally but no suspicious processes are visible in Task Manager, and file system audits show no unexpected files. The analyst suspects a rootkit is hiding the malicious activity. Which type of rootkit is most likely responsible for hiding processes and files from standard system tools?
Select an answer first
18application · medium
A security team is investigating a server that has been compromised. They suspect a rootkit is hiding malicious processes, but standard tools like Task Manager and 'ps' show no anomalies. Which detection method is most likely to uncover the rootkit?
Select an answer first
19application · medium
A security analyst is investigating a suspected data exfiltration where an employee emailed a series of innocuous-looking JPEG images to a personal account. The analyst suspects that sensitive data may be hidden inside the images. Which technique would the analyst use to confirm this suspicion?
Select an answer first
20foundation · easy
Which Windows command is used to clear the Security event log?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Covering Tracks CEH Practice Questions (Page 4)

Questions 16–20

A security team is investigating a server that has been compromised. They suspect a rootkit is hiding malicious processes, but standard tools like Task Manager and 'ps' show no anomalies. Which detection method is most likely to uncover the rootkit?

A security analyst is investigating a suspected data exfiltration where an employee emailed a series of innocuous-looking JPEG images to a personal account. The analyst suspects that sensitive data may be hidden inside the images. Which technique would the analyst use to confirm this suspicion?

Which Windows command is used to clear the Security event log?

Keep studying — System Hacking Phases and Attack Techniques