CEH Enumeration and System Hacking Practice Question
After compromising a system, an attacker wants to erase their tracks. They clear the Windows Event Logs using `wevtutil cl` commands. However, the logs are forwarded to a remote SIEM. Which covering tracks technique would be MOST effective to avoid detection?
⚠ Common exam trap
Test-takers frequently assume clearing logs (wevtutil cl) is sufficient, but the question explicitly states logs are forwarded to a remote SIEM, making any disruption to the log stream (disabling, encrypting, or clearing) a red flag, whereas targeted modification of entries is stealthier and avoids breaking the forwarding pipeline.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify specific event log entries to remove evidence of their actions
Modifying specific event log entries directly removes the incriminating evidence without disrupting the logging pipeline. Since logs are forwarded to a remote SIEM, simply clearing or disabling local logs would trigger an alert due to a gap in log forwarding. By surgically editing only the relevant entries (e.g., using PowerShell or API calls to alter Event Log records), the attacker avoids detection while the SIEM continues to receive logs, maintaining the appearance of normal operation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Modify specific event log entries to remove evidence of their actions
Why this is correct
Modifying specific event log entries is the most sophisticated method for post-compromise evidence removal, as it allows for targeted deletion. Attackers employ specialized tools to parse event logs, identify incriminating entries related to their activities—such as failed logins, privilege escalation, or command execution—and then selectively delete or alter these records. This technique maintains the appearance of normal system operation by leaving benign log data intact, making detection by SIEMs or forensic analysts significantly more challenging than simply clearing all logs.
- ✗
Disable Windows Event Log service (EventLog)
Why it's wrong here
Disabling the Windows Event Log service (EventLog) is a highly conspicuous action that would immediately alert monitoring systems. A Security Information and Event Management (SIEM) solution, or even basic system health checks, would detect the sudden cessation of log forwarding or the absence of expected log entries. This creates an obvious gap in the logging timeline, unequivocally indicating a system compromise rather than subtly hiding attacker actions.
- ✗
Use a rootkit to hide files and processes
Why it's wrong here
While rootkits are effective for maintaining persistence and concealing an attacker's current presence on a system, they primarily function by hiding files, processes, and network connections from the operating system. A rootkit does not inherently modify or erase historical event log entries that document the initial breach, privilege escalation, or other past actions. Therefore, forensic analysis of existing logs would still reveal the attacker's activities, despite the rootkit's operational stealth.
- ✗
Encrypt the log files
Why it's wrong here
Encrypting active log files would render them unreadable by the operating system and any log collection agents, immediately causing critical system errors or halting log generation entirely. This drastic and anomalous change would trigger immediate alerts within a monitored environment, as log forwarding would cease and system stability would be compromised. Such an action draws maximum attention to the compromised system, making it counterproductive for stealthy evidence removal.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.