CEH Enumeration and System Hacking Practice Question
A forensic analyst finds a system where the user's password hash was obtained and cracked offline. The attacker then used stolen credentials to log in and run `wevtutil cl system`. What is the purpose of this command?
⚠ Common exam trap
Many candidates confuse `wevtutil cl system` with commands that delete system files or disable security features, but it specifically targets event logs, which is a key anti-forensics technique tested in the CEH exam.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Clear the System event log
The `wevtutil cl system` command clears the System event log on Windows. After cracking the user's password hash offline, the attacker logs in with stolen credentials and runs this command to erase forensic evidence of their activities, such as logon events or service failures, from the System log. This is a common post-exploitation step to hinder incident response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remove scheduled tasks
Why it's wrong here
Removing scheduled tasks primarily aims to eliminate persistence mechanisms or future actions set up by an attacker. While this might remove evidence of how an attacker maintained access or planned subsequent actions, it does not directly erase the historical record of a user's password being changed or other system events logged at the time of the change. The event logs, where such changes are recorded, remain intact.
- ✗
Delete the SAM database
Why it's wrong here
Deleting the Security Account Manager (SAM) database is a highly destructive action that would render the local user accounts unusable and likely prevent the system from booting correctly. While the SAM database stores password hashes, deleting it does not clear the event logs that record password change events. Instead, it causes catastrophic system failure, making it an obvious and impractical method for subtly obscuring a password change event.
- ✗
Disable Windows Defender
Why it's wrong here
Disabling Windows Defender, an integrated antivirus and anti-malware solution, would reduce the system's security posture and potentially allow malicious software to run undetected. However, Windows Defender's primary function is threat detection and prevention, not logging user authentication or password change events. Therefore, disabling it has no direct impact on the System event log or the recording of a user's password modification.
- ✓
Clear the System event log
Why this is correct
Clearing the System event log is a common anti-forensic technique used by attackers to remove traces of their activity. While specific password change events are typically found in the Security event log, the System log records critical operational events, errors, and warnings that could indirectly indicate system tampering or actions taken during an intrusion. Erasing this log directly removes a significant source of forensic evidence.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.