Countermeasures Across Hacking Phases EHE Practice Questions (Page 8)

Questions 36–39

1. 36foundation · easy

   Why is centralized logging an important countermeasure for the covering tracks phase?

   • AIt reduces the amount of log data generated
   • BIt makes it harder for attackers to tamper with logs because they are stored on a separate system
   • CIt encrypts all log data, preventing attackers from reading it
   • DIt automatically patches vulnerabilities in the logging system
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A security team is reviewing the effectiveness of their endpoint protection. They want to detect a rootkit that hides its processes and files from the operating system. Which approach is most likely to detect such a rootkit?

   • AReview the system's event logs for unusual entries.
   • BCheck the system's running processes using Task Manager.
   • CRun a standard antivirus scan with the latest signatures.
   • DCompare the output of system calls with the raw data on disk.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security administrator is reviewing the logging infrastructure after a suspected breach. The attacker appears to have deleted or modified log entries on several servers to cover their tracks. Which countermeasure would be the most effective to prevent this type of log tampering in the future?

   • AIncrease the verbosity of local logs on each server to capture more detail.
   • BDisable logging on servers that handle sensitive data to reduce the attack surface.
   • CConfigure the servers to send all logs to a centralized, write-once logging server that only allows append operations.
   • DSet local logs to overwrite themselves after 30 days.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company's IT team is hardening a new server before deployment. They want to reduce the risk of an attacker gaining access through known vulnerabilities. Which action is most directly aligned with this goal?

   • AApply the latest security patches and updates to the operating system and applications.
   • BConfigure the server to use a static IP address.
   • CInstall a network intrusion detection system (IDS) on the same subnet.
   • DEnable the built-in guest account for emergency access.
   Reveal Solution Discussion Select an answer first