What is the primary purpose of covering tracks during the system hacking phases?

To increase the speed of the attack and reduce the time spent on the target system

To create a backup of the system's data before performing further exploitation

To remove all evidence of the attack and maintain access without raising suspicion

To ensure the target system remains fully functional and available to legitimate users

A security administrator is trying to remove a suspected kernel-mode rootkit from a Windows server. The administrator has already run antivirus scans and removed the malicious files, but the rootkit persists after reboot. Which additional step should the administrator take to effectively eliminate the rootkit?

Disable System Restore and delete all restore points

Reinstall the affected application that was compromised

Use `sfc /scannow` to repair system files

Boot from a trusted recovery environment and run a rootkit removal tool that scans the Master Boot Record and system files

What is steganography?

The process of encrypting data so that it cannot be read without a key

The technique of compressing data to reduce its size

The method of deleting data to prevent recovery

The practice of hiding a secret message within another, non-secret file or medium

Which of the following is an example of an anti-forensics technique?

Wiping free space on a hard drive to prevent recovery of deleted files

Using a file integrity monitor to detect changes

Creating a forensic image of a disk

Enabling verbose logging on a server

EC-CouncilCertified Ethical Hacker

Domain 3Objective 6

Covering Tracks CEH Practice Questions (Page 9)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

10concepts

Questions 41–45

41foundation · easy
Which Windows utility is commonly used to clear event logs from the command line?
Select an answer first
42foundation · easy
What is the primary purpose of covering tracks during the system hacking phases?
Select an answer first
43expert · hard
A security administrator is trying to remove a suspected kernel-mode rootkit from a Windows server. The administrator has already run antivirus scans and removed the malicious files, but the rootkit persists after reboot. Which additional step should the administrator take to effectively eliminate the rootkit?
Select an answer first
44foundation · easy
What is steganography?
Select an answer first
45foundation · easy
Which of the following is an example of an anti-forensics technique?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Covering Tracks CEH Practice Questions (Page 9)

Questions 41–45

Which Windows utility is commonly used to clear event logs from the command line?

What is the primary purpose of covering tracks during the system hacking phases?

What is steganography?

Which of the following is an example of an anti-forensics technique?

Keep studying — System Hacking Phases and Attack Techniques