Maintaining Access and Persistence CEH Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A penetration tester has gained initial access to a Windows server with a standard user account. The engagement requires maintaining access for 60 days, but the tester cannot rely on the user being logged in and must avoid detection by the organization's EDR solution. The tester has identified a local privilege escalation vulnerability that requires a reboot to exploit. Which approach best balances reliability and stealth?

   • AExploit the privilege escalation vulnerability, then install a Windows service that runs as SYSTEM and uses a custom protocol to communicate with the tester.
   • BInstall a rootkit to hide the persistence mechanism, but do not escalate privileges.
   • CAdd a registry Run key under HKCU that launches the payload.
   • DCreate a scheduled task that runs as the current user and connects to the tester's server.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   How do attackers typically implant a backdoor on a compromised system?

   • ABy exploiting a vulnerability to install a malicious program that listens for incoming connections
   • BBy disconnecting the system from the network
   • CBy changing the system's wallpaper to a malicious image
   • DBy upgrading the system's operating system to a newer version
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   During a red team exercise, an analyst discovers that an attacker has been maintaining access to a Linux server by connecting to a non-standard port that is not associated with any known service. The connection persists even after the attacker's initial exploit is patched. Which action best describes the attacker's technique?

   • AThe attacker used a rootkit to hide the malicious process from the system administrator.
   • BThe attacker implanted a backdoor that listens on a custom port, allowing bypass of normal authentication.
   • CThe attacker modified a system service to restart automatically after the exploit is patched.
   • DThe attacker used a trojan disguised as a legitimate system utility to maintain access.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst is investigating a suspected breach and finds that the attacker has been maintaining access for several weeks. The analyst notices that the event logs have been cleared and that the attacker's scheduled task is hidden from the task scheduler. Which phase of the system hacking methodology does this behavior represent?

   • AReconnaissance, which involves gathering information about the target.
   • BMaintaining access, which involves installing persistence mechanisms.
   • CCovering tracks, which involves clearing logs and hiding evidence to avoid detection.
   • DPrivilege escalation, which involves gaining higher privileges.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A penetration tester has gained access to a Windows machine as a standard user. The tester needs to install a kernel-mode rootkit to maintain stealthy persistence. What must the tester do first?

   • AUse steganography to hide the rootkit in an image file
   • BEscalate privileges to Administrator or SYSTEM
   • CCreate a scheduled task to run the rootkit at logon
   • DAdd a registry run key for the rootkit
   Reveal Solution Discussion Select an answer first