CEH Enumeration and System Hacking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Privilege escalation

  Why it's wrong here

  Privilege escalation refers to the act of gaining higher access rights than initially obtained on a compromised system, such as moving from a regular user to root. While an attacker might alter logs *after* escalating privileges to hide their actions, the act of log alteration itself is not the escalation. It is a distinct post-exploitation activity aimed at maintaining persistence or evading detection, rather than the process of gaining elevated permissions.

• ✗

  Executing applications

  Why it's wrong here

  Executing applications is a fundamental operation on any operating system, where a user or process runs a program to perform a specific task. An attacker will certainly execute various applications during an intrusion, such as malware, reconnaissance tools, or system utilities. However, the act of simply running an application does not inherently involve or describe the specific action of manipulating system logs to conceal evidence. Log manipulation is a separate, deliberate action often performed by specific tools or commands after other applications have achieved their primary objective.

• ✗

  Spying

  Why it's wrong here

  Spying, in a cybersecurity context, typically involves reconnaissance, monitoring system activities, or exfiltrating sensitive data without detection. This could include observing user behavior, capturing network traffic, or copying files. While an attacker engaged in spying aims to remain undetected, the act of log tampering is a specific forensic countermeasure designed to *destroy* or *alter* existing evidence of past actions, rather than the ongoing passive observation or active data collection that defines spying.

• ✓

  Erasing tracks

  Why this is correct

  Erasing tracks is a critical post-exploitation phase where an attacker attempts to remove or obscure any evidence of their presence and activities on a compromised system. This directly involves manipulating system logs, such as /var/log/auth.log or ~/.bash_history, by truncating, deleting, or modifying entries. Reducing logging levels or disabling logging services are also common techniques to prevent future actions from being recorded, thereby making forensic analysis significantly more challenging and hindering incident response efforts.

Go deeper

Related to this question