On a Linux system, which command can be used to delete the contents of a log file without deleting the file itself?

cat /dev/null > /var/log/auth.log

A security administrator wants to strengthen the logging configuration on a Windows server to make it harder for an attacker to cover tracks by clearing event logs. Which configuration change is most effective for this purpose?

Configure event log retention to 'Do not overwrite events' and set a large maximum size

Set the event log maximum size to a small value so logs rotate quickly

Disable the Windows Event Log service to prevent logging

Set the event log to 'Overwrite events as needed'

Which action is an example of log obfuscation?

Compressing the log file to save space

Changing the timestamp of a log entry to make it appear as if it occurred at a different time

A forensic investigator is analyzing a Windows system and finds a suspicious file that appears to be a legitimate system DLL. The investigator suspects that the file contains hidden data in an Alternate Data Stream. Which approach would best confirm the presence of ADS and extract the hidden data?

Use `sfc /scannow` to verify the file's integrity

Use `dir /r` to list ADS and then use `type` with the stream name to view the content

Use `attrib` to check for hidden attributes

Use `regedit` to search for the file in the registry

EC-CouncilCertified Ethical Hacker

Domain 3Objective 6

Covering Tracks CEH Practice Questions (Page 8)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

10concepts

Questions 36–40

36foundation · easy
On a Linux system, which command can be used to delete the contents of a log file without deleting the file itself?
Select an answer first
37application · medium
A security administrator wants to strengthen the logging configuration on a Windows server to make it harder for an attacker to cover tracks by clearing event logs. Which configuration change is most effective for this purpose?
Select an answer first
38foundation · easy
Which type of rootkit operates by replacing or modifying system libraries or kernel modules?
Select an answer first
39foundation · easy
Which action is an example of log obfuscation?
Select an answer first
40expert · medium
A forensic investigator is analyzing a Windows system and finds a suspicious file that appears to be a legitimate system DLL. The investigator suspects that the file contains hidden data in an Alternate Data Stream. Which approach would best confirm the presence of ADS and extract the hidden data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.