A security consultant is tasked with exfiltrating sensitive data from a corporate network without being detected by network monitoring tools that inspect outbound traffic for unusual file transfers. The consultant needs to hide the data within legitimate-looking traffic. Which technique is most appropriate?

Embed the data in the least significant bits of an image file and upload it to a public image hosting service

Convert the data to base64 and paste it into a comment on a public forum

Encrypt the data and send it as a binary attachment in an email

Compress the data into a password-protected ZIP file and upload it to a file-sharing site

A penetration tester is performing a red team exercise and has compromised a Linux server. The tester needs to hide a specific command execution from the bash history and also make a failed SSH login attempt appear as a successful one in the auth log. The tester wants to avoid detection by a savvy administrator who checks for common log manipulation techniques. Which combination of actions is most effective?

Edit the bash history file to remove the specific command and modify the auth log entry to change 'Failed' to 'Accepted'

Use the 'unset' command to clear history and reboot the server

Disable bash history and stop the syslog service

Clear the entire bash history and delete the auth log

What is the purpose of an auditing policy in Windows?

To define which security events are recorded in the event logs

To block unauthorized users from accessing the system

To automatically delete old event logs

To encrypt the event logs to protect them from unauthorized access

A system administrator wants to detect a potential kernel-mode rootkit on a critical Linux server. The administrator has access to the server's filesystem and can run commands. Which detection technique is most likely to reveal a kernel-mode rootkit that hides processes and network connections?

Compare the output of system commands like 'ps' and 'netstat' with raw data from /proc and /sys

Run a signature-based antivirus scan on the server

Review the server's firewall rules for open ports

Check the server's uptime and reboot history

A Linux administrator notices that the `/var/log/auth.log` file is missing entries for a specific time period. The administrator suspects an attacker deleted those entries. Which command-line tool could the attacker have used to delete specific lines from the log file?

`touch` to update the file timestamp

`sed` with a range or pattern to delete lines

`chmod` to change file permissions

EC-CouncilCertified Ethical Hacker

Domain 3Objective 6

Covering Tracks CEH Practice Questions (Page 6)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

10concepts

Questions 26–30

26application · medium
A security consultant is tasked with exfiltrating sensitive data from a corporate network without being detected by network monitoring tools that inspect outbound traffic for unusual file transfers. The consultant needs to hide the data within legitimate-looking traffic. Which technique is most appropriate?
Select an answer first
27expert · hard
A penetration tester is performing a red team exercise and has compromised a Linux server. The tester needs to hide a specific command execution from the bash history and also make a failed SSH login attempt appear as a successful one in the auth log. The tester wants to avoid detection by a savvy administrator who checks for common log manipulation techniques. Which combination of actions is most effective?
Select an answer first
28foundation · easy
What is the purpose of an auditing policy in Windows?
Select an answer first
29application · medium
A system administrator wants to detect a potential kernel-mode rootkit on a critical Linux server. The administrator has access to the server's filesystem and can run commands. Which detection technique is most likely to reveal a kernel-mode rootkit that hides processes and network connections?
Select an answer first
30application · medium
A Linux administrator notices that the `/var/log/auth.log` file is missing entries for a specific time period. The administrator suspects an attacker deleted those entries. Which command-line tool could the attacker have used to delete specific lines from the log file?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Covering Tracks CEH Practice Questions (Page 6)

Questions 26–30

What is the purpose of an auditing policy in Windows?

A system administrator wants to detect a potential kernel-mode rootkit on a critical Linux server. The administrator has access to the server's filesystem and can run commands. Which detection technique is most likely to reveal a kernel-mode rootkit that hides processes and network connections?

A Linux administrator notices that the `/var/log/auth.log` file is missing entries for a specific time period. The administrator suspects an attacker deleted those entries. Which command-line tool could the attacker have used to delete specific lines from the log file?

Keep studying — System Hacking Phases and Attack Techniques