How does maintaining access enable continued exploitation of a compromised system?

By disabling all security controls on the target system permanently

By immediately removing all traces of the attack from the system

By ensuring the system is patched against all known vulnerabilities

By providing a persistent foothold that allows the attacker to return and perform further actions over time

A system administrator is reviewing a compromised Linux server and finds that a new user account was created with UID 0 and a valid shell. The account does not appear in the /etc/passwd file when viewed with standard tools. Which persistence mechanism is most likely in use?

A rootkit that hides the user account from system tools.

A scheduled task that runs a malicious script.

A backdoor that listens on a non-standard port.

A trojan that disguises itself as a legitimate system process.

What is the primary purpose of a backdoor in the context of system hacking?

To scan for open ports on other systems

To encrypt the victim's files and demand a ransom

To bypass normal authentication and provide future access to the system

To monitor network traffic for passwords

Why is privilege escalation important for maintaining persistence on a compromised system?

Because it prevents the system from logging any of the attacker's actions

Because it speeds up the initial exploitation process

Because higher privileges allow the attacker to install deeper system-level persistence mechanisms

Because it allows the attacker to change the system's IP address

A penetration tester has compromised a Windows server and established persistence via a scheduled task. The tester now wants to cover tracks, but the SOC has enabled 'Audit Process Creation' and 'Audit Logon' events. Which action is most likely to avoid detection?

Use a script to delete only the specific event log entries related to the scheduled task creation and execution

Clear the entire Security log to remove all evidence

Modify the registry to disable auditing

Disable the Windows Event Log service

EC-CouncilCertified Ethical Hacker

Domain 3Objective 5

Maintaining Access and Persistence CEH Practice Questions (Page 8)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

9concepts

Questions 36–40

36foundation · easy
How does maintaining access enable continued exploitation of a compromised system?
Select an answer first
37application · medium
A system administrator is reviewing a compromised Linux server and finds that a new user account was created with UID 0 and a valid shell. The account does not appear in the /etc/passwd file when viewed with standard tools. Which persistence mechanism is most likely in use?
Select an answer first
38foundation · easy
What is the primary purpose of a backdoor in the context of system hacking?
Select an answer first
39foundation · easy
Why is privilege escalation important for maintaining persistence on a compromised system?
Select an answer first
40expert · hard
A penetration tester has compromised a Windows server and established persistence via a scheduled task. The tester now wants to cover tracks, but the SOC has enabled 'Audit Process Creation' and 'Audit Logon' events. Which action is most likely to avoid detection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.