Maintaining Access and Persistence CEH Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which statement best describes a rootkit?

   • AA network scanner used to identify open ports
   • BA tool for cracking wireless network passwords
   • CA type of antivirus software that removes other malware
   • DA set of tools that hides the presence of malware and provides continued privileged access
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   In the system hacking phases, what is the primary goal of the 'maintaining access' phase?

   • ATo immediately delete all logs and traces of the initial intrusion
   • BTo escalate privileges to the highest level on the target system
   • CTo ensure the attacker can return to the compromised system without repeating the initial exploitation steps
   • DTo scan the network for additional vulnerable systems
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A penetration tester has gained initial access to a Windows server with a low-privileged user account. The tester needs to install a persistence mechanism that survives reboots and runs with SYSTEM privileges. Which step is most critical to achieve this goal?

   • ACreate a new user account and add it to the Administrators group.
   • BClear the event logs to avoid detection during the installation.
   • CEscalate privileges to an administrator or SYSTEM account before installing the persistence mechanism.
   • DUse steganography to hide the payload in a legitimate image file.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   How does a trojan help an attacker maintain access to a system?

   • ABy slowing down the system to make it easier to exploit
   • BBy opening a hidden backdoor once the trojan is executed
   • CBy encrypting the hard drive to prevent the user from accessing files
   • DBy displaying fake security alerts to trick the user into buying software
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A security team wants to detect rootkits on their Windows endpoints. Which approach is most effective for detecting kernel-mode rootkits?

   • AManually review the kernel memory for suspicious patterns.
   • BUse a trojan to hide the detection tool from the rootkit.
   • CUse a rootkit detection tool that compares system calls and kernel objects to detect anomalies.
   • DDisable all kernel-mode drivers on the endpoints.
   Reveal Solution Discussion Select an answer first