A Linux administrator suspects that an attacker has modified the `auth.log` file to remove failed login attempts. The administrator wants to verify whether the log has been tampered with. Which command or utility would be most appropriate to check the integrity of the log file?

Use `tripwire` to compare the log file against a known baseline

Use `logcheck` to review log summaries

Use `auditctl` to view audit rules

Use `grep` to search for failed login patterns

A penetration tester has successfully escalated privileges on a Windows domain controller and wants to maintain access for a week-long assessment without being detected by the security operations center (SOC). Which action aligns with the purpose of covering tracks?

Clear the Security event log and disable future auditing

Create a hidden local admin account and add it to the domain admins group

Change the system time to confuse the timestamps in logs

Delete the event logs that record the privilege escalation and schedule a task to periodically clean logs

What is an Alternate Data Stream (ADS) in NTFS?

A network protocol used to transfer files between systems

A hidden data stream that can be attached to a file or folder to store additional data without affecting the visible content

A backup copy of a file that is automatically created by Windows

A type of file encryption used to protect sensitive data

What is the goal of log manipulation and obfuscation?

To delete all logs on the system to prevent any record of activity

To make the logs appear normal while hiding or altering the evidence of malicious activity

To move logs to a different location on the system

To encrypt the logs so that only the attacker can read them

EC-CouncilCertified Ethical Hacker

Domain 3Objective 6

Covering Tracks CEH Practice Questions (Page 5)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

10concepts

Questions 21–25

21application · medium
A Linux administrator suspects that an attacker has modified the `auth.log` file to remove failed login attempts. The administrator wants to verify whether the log has been tampered with. Which command or utility would be most appropriate to check the integrity of the log file?
Select an answer first
22foundation · easy
Which rootkit detection technique involves comparing the current state of system files and registry keys to a known-good baseline?
Select an answer first
23application · medium
A penetration tester has successfully escalated privileges on a Windows domain controller and wants to maintain access for a week-long assessment without being detected by the security operations center (SOC). Which action aligns with the purpose of covering tracks?
Select an answer first
24foundation · easy
What is an Alternate Data Stream (ADS) in NTFS?
Select an answer first
25foundation · easy
What is the goal of log manipulation and obfuscation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.