Maintaining Access and Persistence CEH Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is a trojan in the context of maintaining access?

   • AA type of firewall that blocks malicious traffic
   • BA malicious program disguised as legitimate software to trick users into installing it
   • CA tool used to crack passwords by brute force
   • DA program that replicates itself across the network without user interaction
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A penetration tester has gained access to a Windows system with a standard user account. The tester wants to install a kernel-mode rootkit to hide malicious activity. Which step is most critical before installing the rootkit?

   • AUse steganography to hide the rootkit in an image file.
   • BEscalate privileges to SYSTEM or administrator level.
   • CClear the event logs to avoid detection.
   • DCreate a scheduled task to run the rootkit at startup.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security team wants to detect persistence mechanisms that use scheduled tasks or services on Windows endpoints. Which monitoring approach is most effective?

   • APerform regular antivirus scans
   • BReview user login reports
   • CCollect and analyze Windows Event Logs for Task Scheduler and Service Control Manager events
   • DMonitor network traffic for unusual outbound connections
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security consultant is assessing an organization's data exfiltration defenses. The consultant wants to demonstrate how an attacker could hide stolen data within image files and later retrieve it without raising suspicion. Which technique should the consultant use?

   • AA rootkit to hide the data from the operating system.
   • BEncryption to scramble the stolen data so it cannot be read without a key.
   • CSteganography to embed the stolen data in the least significant bits of an image file.
   • DA backdoor to provide covert access to the stolen data.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A red team has achieved initial access to a Windows workstation via a phishing email. The engagement requires maintaining access for 30 days, but the workstation is frequently rebooted and the user often logs off. The red team also wants to avoid generating new event log entries that could alert the SOC. Which persistence approach best balances reliability and stealth?

   • AReplace a legitimate scheduled task with a malicious one that runs at logon
   • BCreate a scheduled task that runs at system startup and uses a reflective DLL to inject into a legitimate process
   • CAdd a run key under HKCU to execute a PowerShell script that downloads the payload
   • DInstall a Windows service that runs a reverse shell as SYSTEM
   Reveal Solution Discussion Select an answer first