Gaining Access, Maintaining Access, and Covering Tracks EHE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security team is conducting a red team exercise. The team has gained access to a user's workstation and wants to escalate privileges to domain administrator. The team has captured a Kerberos ticket for the user. Which attack is most likely to succeed?

   • ABrute-force attack to crack the Kerberos ticket and obtain the password.
   • BUse the ticket to request a new ticket with higher privileges via a Kerberoasting attack.
   • CPass-the-ticket attack using the captured Kerberos ticket to access other services.
   • DUse the ticket to perform a golden ticket attack by forging a new ticket.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A penetration tester needs to maintain access to a compromised Linux server for a week-long assessment. The tester wants to avoid creating any new files on the disk and avoid modifying system binaries. Which method is most appropriate?

   • AUse a memory-resident rootkit that injects a backdoor into the SSH daemon process.
   • BAdd a cron job that downloads and executes a reverse shell from a remote server.
   • CReplace the `sshd` binary with a backdoored version that allows a secret password.
   • DCreate a new user account with UID 0 and hide it from `/etc/passwd` using a rootkit.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which type of malicious software is designed to provide continued privileged access to a compromised system while hiding its presence from users and security tools?

   • AWorm
   • BRootkit
   • CKeylogger
   • DRansomware
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   After compromising a Windows workstation through a phishing email, an attacker wants to avoid detection by the organization's SIEM, which aggregates logs from all endpoints. The attacker has administrative privileges. Which action is most effective for covering tracks in this environment?

   • AModify the local event log settings to stop forwarding logs to the SIEM and then delete specific event IDs related to the attack.
   • BClear the local Security event log and disable Windows Defender.
   • CChange the system time to a date before the attack to confuse log correlation.
   • DUse a tool to overwrite free space on the hard drive to prevent forensic recovery of deleted files.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A penetration tester has successfully exploited a web application vulnerability and obtained a low-privilege shell on a Linux server. The tester needs to escalate privileges to root and then ensure continued access even if the vulnerability is patched. Which approach best achieves both objectives?

   • AUse a password-spraying attack against the root account, then enable SSH password authentication and log in as root directly.
   • BDelete all application logs to avoid detection, then reboot the server to clear any temporary files and hope the vulnerability remains exploitable.
   • CUpload a web shell, use it to modify the /etc/passwd file to add a new root user, and then connect via SSH as that user.
   • DExploit a local privilege escalation vulnerability to gain root, then install a hidden backdoor that listens on a non-standard port and connects back to the tester's machine.
   Reveal Solution Discussion Select an answer first