An attacker has compromised a Linux server and installed a backdoor. The attacker now wants to cover tracks by hiding the backdoor process and any related files. The server is running a security agent that monitors process lists and file system changes. Which technique is most likely to evade the security agent?

Use a userland rootkit that hooks system calls to hide the process and files from the operating system.

Place the backdoor files in a directory with a name starting with a dot, such as '.hidden'.

Set the backdoor process to run with a low priority so it does not appear in process listings.

Rename the backdoor process to a name that matches a legitimate system process, such as 'sshd'.

An attacker has compromised a Windows server and wants to maintain access. The server has a security product that monitors for new services and scheduled tasks. The attacker wants to avoid creating new services or scheduled tasks. Which method is most appropriate?

Modify the registry `Run` key to execute the backdoor at logon.

Create a new Windows service that runs the backdoor.

Add a scheduled task that runs the backdoor at logon.

Use a WMI event subscription to execute a script when the system starts.

EC-CouncilEthical Hacking Essentials

Domain 3Objective 4

Gaining Access, Maintaining Access, and Covering Tracks EHE Practice Questions (Page 3)

Part of the Ethical Hacking Methodology domain, which makes up ~12% of our current practice bank.

26questions here

6free pages

3concepts

Questions 11–15

11expert · hard
An attacker has compromised a Linux server and installed a backdoor. The attacker now wants to cover tracks by hiding the backdoor process and any related files. The server is running a security agent that monitors process lists and file system changes. Which technique is most likely to evade the security agent?
Select an answer first
12foundation · easy
Which technique is commonly used by attackers to cover their tracks by removing evidence of their activities from the system?
Select an answer first
13expert · hard
An attacker has compromised a Windows server and wants to maintain access. The server has a security product that monitors for new services and scheduled tasks. The attacker wants to avoid creating new services or scheduled tasks. Which method is most appropriate?
Select an answer first
14foundation · easy
Which technique for covering tracks involves concealing malicious files by using file attributes or placing them in hidden directories to avoid detection?
Select an answer first
15foundation · easy
Which method for maintaining persistent access involves installing a hidden program that allows an attacker to bypass normal authentication and remotely control the system at any time?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to EHE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “EHE” is a trademark of its owner, used for identification only.

Gaining Access, Maintaining Access, and Covering Tracks EHE Practice Questions (Page 3)

Questions 11–15

Which technique is commonly used by attackers to cover their tracks by removing evidence of their activities from the system?

An attacker has compromised a Windows server and wants to maintain access. The server has a security product that monitors for new services and scheduled tasks. The attacker wants to avoid creating new services or scheduled tasks. Which method is most appropriate?

Which technique for covering tracks involves concealing malicious files by using file attributes or placing them in hidden directories to avoid detection?

Which method for maintaining persistent access involves installing a hidden program that allows an attacker to bypass normal authentication and remotely control the system at any time?

Keep studying — Ethical Hacking Methodology