Gaining Access, Maintaining Access, and Covering Tracks EHE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A penetration tester is assessing a company's security. The tester has gained access to a user's workstation and wants to escalate privileges to domain administrator. The tester has captured a hash of the user's password. Which attack is most likely to succeed?

   • ASocial engineering to trick the administrator into revealing their password.
   • BBrute-force attack to crack the hash and obtain the plaintext password.
   • CKeylogger to capture the domain administrator's password when they log in.
   • DPass-the-hash attack using the captured hash to authenticate to other systems.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   After compromising a database server, an attacker wants to cover tracks by deleting the SQL queries that were executed during the attack. The attacker has access to the database logs. Which action is most effective?

   • ADelete the entire database transaction log file.
   • BUse a tool to overwrite the free space on the database server's hard drive.
   • CDisable database auditing and then restart the database service.
   • DModify the database audit log to remove only the entries related to the attack.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A penetration tester has compromised a Linux server and needs to cover tracks. The server uses `auditd` for auditing and has a file integrity monitoring (FIM) tool that checks critical system files. The tester wants to hide a newly created backdoor binary and its process from the system administrator. Which technique is most effective?

   • APlace the binary in `/tmp` and use a rootkit to hide the file and process.
   • BStore the binary in an Alternate Data Stream (ADS) of a legitimate file and use a userland rootkit to hide the process.
   • CCompress the binary with a packer and rename it to a system-like name, then use a process name that matches a legitimate service.
   • DUse a kernel module to hide the file and process, and add the module to the kernel's module list to survive reboots.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   During the gaining access phase of ethical hacking, which technique involves tricking an employee into revealing their login credentials by posing as a trusted IT support representative?

   • APassword spraying
   • BMan-in-the-middle attack
   • CExploiting a software vulnerability
   • DSocial engineering
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security auditor is testing the resilience of a company's network. The auditor successfully phished an employee and obtained VPN credentials. The auditor wants to gain access to a file server that is only reachable from the internal network. Which technique should the auditor use to achieve this?

   • AConnect to the VPN and then use a port scanner to find the file server's IP and attempt to connect to it using the employee's credentials.
   • BDeploy a Trojan on the employee's workstation to create a reverse tunnel to the file server.
   • CUse the VPN credentials to connect to the internal network and then perform a pass-the-hash attack to access the file server.
   • DUse the VPN credentials to access the employee's email and search for file server passwords.
   Reveal Solution Discussion Select an answer first