CEH Enumeration and System Hacking Practice Question
A security analyst finds multiple failed login attempts in the system logs, followed by a successful login from an unusual IP address. The attacker then deleted the log entries for that session. Which step of the system hacking methodology (CHPSET) does the log deletion represent?
⚠ Common exam trap
Candidates often confuse 'Erasing tracks' with 'Spying' because both involve post-exploitation actions, but spying focuses on data collection while erasing tracks specifically targets log and evidence removal.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Erasing tracks
The log deletion represents the 'Erasing tracks' step in the CHPSET methodology. After gaining unauthorized access, attackers must cover their footprints by removing evidence of their activities, such as clearing system logs, modifying timestamps, or deleting audit trails. This ensures the intrusion remains undetected by system administrators or security monitoring tools.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Spying
Why it's wrong here
Spying, in the context of ethical hacking, refers to the clandestine observation and collection of information about a target's systems, networks, or personnel without direct interaction that would alter the target's state. This typically involves passive reconnaissance techniques like network sniffing, social engineering for intelligence gathering, or monitoring public sources. It does not involve active manipulation or deletion of system artifacts like log files, which would leave a forensic trace.
- ✗
Executing applications
Why it's wrong here
Executing applications involves running specific programs, scripts, or malware on a compromised system to achieve various objectives, such as establishing persistence, escalating privileges, or exfiltrating data. While this action directly interacts with the system, it is distinct from the post-exploitation phase of removing forensic evidence. Running an application itself is an action, not the act of covering one's tracks after an action.
- ✗
Cracking passwords
Why it's wrong here
Cracking passwords is the process of attempting to discover user credentials, often by brute-forcing hashed passwords, using dictionary attacks, or exploiting weak cryptographic implementations. This activity is focused on gaining unauthorized access to accounts or systems by obtaining valid login credentials. While successful password cracking might lead to subsequent actions that generate log entries, the act of cracking itself is about acquisition, not the subsequent deletion of forensic evidence.
- ✓
Erasing tracks
Why this is correct
Erasing tracks, also known as anti-forensics or covering one's tracks, is a critical post-exploitation phase where an attacker attempts to remove or alter evidence of their presence and activities on a compromised system. This often involves deleting or modifying system logs, clearing command history, manipulating timestamps, or using secure deletion tools to prevent forensic analysis and maintain stealth. The goal is to avoid detection and hinder incident response efforts by making it difficult to reconstruct the attack chain.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.