Gaining Access, Maintaining Access, and Covering Tracks EHE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An attacker has compromised a Linux server and wants to maintain access. The server has a security tool that monitors for new listening ports and outbound connections. The attacker wants to avoid detection by this tool. Which method is most appropriate?

   • AUse a DNS tunnel to communicate with the attacker's server.
   • BUse a bind shell that listens on a high port.
   • CUse an SSH tunnel to the attacker's server.
   • DUse a reverse shell that connects outbound to the attacker's server on port 443.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An attacker has compromised a Windows server and wants to hide a malicious executable from the user and from standard file listings. The attacker has administrator privileges. Which technique is most effective for hiding the file?

   • ASet the file's hidden attribute and disable 'Show hidden files' in Explorer.
   • BPlace the file in the `C:\Windows\System32` directory and name it `svchost.exe`.
   • CCompress the executable with a packer and rename it to a `.dll` file.
   • DUse an Alternate Data Stream (ADS) to store the executable in a legitimate file's stream.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst is testing the physical security of a client's office. The analyst wants to demonstrate how an attacker could gain access to the internal network without using technical exploits. Which technique is most appropriate?

   • ATailgating into the office and plugging a rogue device into an open network port.
   • BExploiting a vulnerability in the firewall to gain remote access.
   • CScanning the wireless network for weak encryption and cracking the Wi-Fi password.
   • DSending a phishing email to an employee to obtain their VPN credentials.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst is simulating an external attacker targeting a company's public-facing web server. The analyst has identified a SQL injection vulnerability in the login form and wants to gain access to the backend database. Which technique is most appropriate for this phase?

   • ADeploy a Trojan horse disguised as a software update to trick the administrator into installing it.
   • BUse SQL injection to bypass the login and extract user credentials from the database.
   • CClear the web server logs to hide the SQL injection attempts.
   • DInstall a keylogger on the web server to capture administrator passwords.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A penetration tester successfully exploited a SQL injection flaw on a public-facing web server and obtained a low-privilege shell. The tester needs to escalate privileges to administrator and then ensure continued access even if the web application is patched. Which sequence of actions best achieves the tester's goals while minimizing the chance of immediate detection?

   • AUpload a web shell, add a new administrator account, and delete the web server access logs.
   • BUse a local privilege escalation exploit, install a kernel-mode rootkit to hide the process, and clear relevant event logs.
   • CReplace the login binary with a Trojan that captures credentials and modify the system time to confuse forensic analysis.
   • DCreate a scheduled task that runs a reverse shell every hour and disable the Windows Event Log service.
   Reveal Solution Discussion Select an answer first