Maintaining Access and Persistence CEH Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A penetration tester has successfully exploited a vulnerability and gained access to a target system. The tester wants to ensure that they can return to the system even if the vulnerability is patched. Which action best supports the goal of maintaining access?

   • AClear the event logs to remove evidence of the initial exploit.
   • BEscalate privileges to gain administrative control.
   • CInstall a persistence mechanism, such as a scheduled task or service, that runs the payload.
   • DUse steganography to hide the exploit code in an image file.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is an effective countermeasure to prevent attackers from implanting persistence mechanisms?

   • AApplying security patches and hardening the system configuration
   • BRemoving all antivirus software to avoid false positives
   • CAllowing all inbound connections to simplify remote access
   • DDisabling the Windows Event Log to save disk space
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team is investigating a server that is suspected of being compromised. The server's EDR solution is not detecting any malicious activity, but the team suspects a kernel-mode rootkit is present. Which approach is most effective for confirming the presence of a kernel-mode rootkit?

   • ACheck the system event logs for kernel errors.
   • BRun a rootkit detection tool from within the running operating system.
   • CBoot the server from a trusted forensic boot media and compare the kernel memory and system files against known-good baselines.
   • DUse a network scanner to look for unusual open ports.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security analyst is investigating a compromised Windows workstation. The analyst finds a trojanized version of a legitimate productivity tool that is signed with a valid certificate. The trojan creates a scheduled task that runs a PowerShell script to download additional payloads. The analyst wants to remove the trojan and prevent it from running again. Which approach is most effective?

   • AOnly delete the scheduled task, as the trojanized executable is signed and therefore legitimate.
   • BOnly remove the trojanized executable, as the scheduled task will fail without it.
   • CDisable the scheduled task and leave the trojanized executable for further analysis.
   • DDelete the scheduled task, remove the trojanized executable, and revoke the certificate if it was stolen.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is NOT a typical persistence mechanism?

   • AInstalling a malicious service that starts automatically
   • BAdding a program to the Startup folder of the current user
   • CCreating a scheduled task that runs a malicious script daily
   • DChanging the system's time zone to a different region
   Reveal Solution Discussion Select an answer first