A forensic analyst is investigating a compromised Linux server. The analyst runs 'lsmod' and sees no suspicious kernel modules, but the server's behavior indicates a rootkit may be present. Which technique could the rootkit be using to evade detection?

Using a user-mode rootkit that replaces the lsmod binary

Storing the module in a hidden directory

Hooking the sys_read or sys_getdents system calls to filter module listings

Encrypting the module file on disk

A penetration tester has gained initial access to a Windows workstation in a corporate environment. The tester needs to ensure that command-and-control communication resumes automatically after the user reboots the machine, without requiring the user to log on. Which persistence mechanism best meets this requirement?

Modify the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce key

Place a shortcut in the user's Startup folder

Create a scheduled task configured to run at system startup with the 'Run whether user is logged on or not' option

Add a run key under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

A user reports that their computer is running slowly and that a new 'system update' program appeared in the notification area. The user does not remember installing it. Which type of malware is most likely present?

A backdoor that listens on a network port

A scheduled task that runs a script

A trojan disguised as a system update

A rootkit that hides its processes

A penetration tester has compromised a Windows domain controller and wants to avoid detection by the security operations center (SOC). The tester has already established persistence via a service. Which action is most important to cover tracks?

Disable the firewall to allow outbound connections

Delete or modify the event logs that record service creation and logon events

Change the service name to a legitimate-looking name

What is the primary advantage of using steganography for maintaining covert access?

It allows the malicious data to spread to other systems automatically

It makes the malicious data unreadable without a special key

It hides the existence of the malicious data, making it less likely to be discovered

It ensures the malicious data is automatically deleted after a certain time

EC-CouncilCertified Ethical Hacker

Domain 3Objective 5

Maintaining Access and Persistence CEH Practice Questions (Page 6)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

9concepts

Questions 26–30

26application · medium
A forensic analyst is investigating a compromised Linux server. The analyst runs 'lsmod' and sees no suspicious kernel modules, but the server's behavior indicates a rootkit may be present. Which technique could the rootkit be using to evade detection?
Select an answer first
27application · medium
A penetration tester has gained initial access to a Windows workstation in a corporate environment. The tester needs to ensure that command-and-control communication resumes automatically after the user reboots the machine, without requiring the user to log on. Which persistence mechanism best meets this requirement?
Select an answer first
28application · medium
A user reports that their computer is running slowly and that a new 'system update' program appeared in the notification area. The user does not remember installing it. Which type of malware is most likely present?
Select an answer first
29application · medium
A penetration tester has compromised a Windows domain controller and wants to avoid detection by the security operations center (SOC). The tester has already established persistence via a service. Which action is most important to cover tracks?
Select an answer first
30foundation · easy
What is the primary advantage of using steganography for maintaining covert access?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.