Covering Tracks CEH Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   On a Linux system, which command can be used to change the modification timestamp of a file to hide when it was last accessed?

   • Arm file.txt
   • Bchmod 777 file.txt
   • Cls -l file.txt
   • Dtouch -t 202301010000 file.txt
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is a rootkit?

   • AA type of malware that provides privileged access and hides its presence and activities from the operating system and security tools
   • BA type of firewall that blocks malicious traffic
   • CA tool used to crack passwords and gain unauthorized access
   • DA network scanner used to identify open ports
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   An advanced persistent threat (APT) group has established a foothold in a corporate network and wants to maintain long-term access without being detected. They have already compromised a domain controller and have administrative privileges. Their goal is to avoid triggering any security alerts while continuing to collect sensitive data. Which approach best balances the need to maintain access and avoid detection?

   • AUse a kernel-mode rootkit to hide malicious processes and selectively delete only the event log entries related to their activity
   • BCreate a new administrator account and use it for all future access, while leaving existing logs untouched
   • CClear all event logs on the domain controller and disable auditing policies
   • DExfiltrate data only during off-peak hours to reduce the chance of detection
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A penetration tester has completed a post-exploitation phase on a Windows Server 2019 target and needs to remove evidence of the activity from the Security event log. The tester wants to delete only the specific event IDs related to their actions while leaving other log entries intact. Which approach best achieves this objective?

   • AUse wevtutil to clear the entire Security log
   • BDisable the Windows Event Log service and restart the server
   • CUse PowerShell to query and remove specific event records from the Security log
   • DOverwrite the Security log with a backup copy from a previous date
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A penetration tester needs to exfiltrate a sensitive database dump from a Windows server without being detected by network monitoring that inspects file contents. The tester has access to the server and can create files. Which technique would best conceal the data during transfer?

   • AHide the data in an NTFS Alternate Data Stream and send the file via FTP
   • BEmbed the data inside a JPEG image using steganography and upload the image to a public file-sharing site
   • CRename the dump file to .txt and send it as a plain text attachment
   • DCompress the data and encode it in Base64 before sending it in an email
   Reveal Solution Discussion Select an answer first