Maintaining Access and Persistence CEH Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   During a penetration test, the tester has gained initial access to a low-privilege account on a domain-joined workstation. The tester's goal is to maintain access for a long-term assessment. Which combination of actions best supports this goal?

   • ACreate a new local user account and add it to the Administrators group
   • BEscalate privileges to local administrator and install a service that runs a reverse shell
   • CUse a keylogger to capture credentials and log them to a file
   • DDisable Windows Defender to avoid detection
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team wants to detect persistence mechanisms that use registry Run keys and scheduled tasks on their Windows endpoints. Which approach is most effective for this purpose?

   • AManually review the registry and scheduled tasks once a month.
   • BUse a rootkit to hide the monitoring tools from potential attackers.
   • CDisable all scheduled tasks and registry Run keys on the endpoints.
   • DDeploy endpoint detection and response (EDR) tools that monitor registry and scheduled task changes in real time.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which method can help detect persistence mechanisms such as registry run keys and scheduled tasks?

   • ADisabling the system's built-in firewall
   • BChanging the administrator password regularly
   • CMonitoring system startup locations and scheduled tasks for unauthorized changes
   • DDefragmenting the hard drive
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security administrator wants to harden Windows endpoints against persistence mechanisms that use registry run keys. Which configuration is most effective?

   • AUse Group Policy to remove the Run key from the registry
   • BDisable the Windows Registry Editor
   • CEnable Windows Defender Application Control to block unauthorized executables from running
   • DSet the HKEY_LOCAL_MACHINE\...\Run key to read-only
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A red team operator has implanted a backdoor on a Linux server that listens on port 4444. The backdoor is configured to start automatically via a systemd service. The operator wants to ensure that the backdoor remains hidden from the system administrator and that the service does not appear in the systemctl list. Which additional technique should the operator use?

   • AInstall a rootkit that hides the backdoor process and the systemd service from system tools.
   • BUse steganography to hide the backdoor binary in an image file.
   • CChange the backdoor to listen on a non-standard port.
   • DClear the system logs to remove evidence of the backdoor installation.
   Reveal Solution Discussion Select an answer first