CEH Enumeration and System Hacking Practice Question
After gaining access to a system, an attacker modifies log files to remove evidence of their activities. This action is part of which phase of the system hacking methodology?
⚠ Common exam trap
It's easy for candidates to confuse 'Hiding files' (option C) with 'Erasing tracks,' but hiding files focuses on concealing payloads, while erasing tracks specifically targets log files and audit trails to cover the attacker's digital footprint.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Erasing tracks
'Erasing tracks,' because after gaining access, the attacker's goal is to cover their footprints by modifying or deleting log files, clearing event logs, or using tools like `wevtutil` or `clearev` to remove evidence of their activities. This phase ensures the system administrator cannot detect the intrusion or trace the attacker's actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Spying
Why it's wrong here
Spying, in the context of post-exploitation, refers to the act of covertly observing system activities, user interactions, or network traffic to gather sensitive information. This typically involves deploying keyloggers, screen capture tools, or network sniffers to exfiltrate data without altering the system's operational state or forensic evidence. Modifying logs is an active manipulation of system data, not a passive observation technique.
- ✗
Executing applications
Why it's wrong here
Executing applications involves launching specific programs, scripts, or malware on a compromised system to achieve various post-exploitation objectives, such as establishing persistence, escalating privileges, or deploying additional tools. While an attacker might execute a log-clearing utility or a script to modify logs, the act of "executing applications" itself describes the *method* of running software, not the *specific objective* of altering forensic evidence.
- ✗
Hiding files
Why it's wrong here
Hiding files refers to the technique of concealing malicious executables, configuration files, or exfiltrated data within the file system to evade detection. This can involve using hidden attributes, steganography, or manipulating file system structures like Alternate Data Streams (ADS) on NTFS to make data invisible. While related to covering tracks, it specifically pertains to making files undetectable, whereas modifying logs is about altering recorded events.
- ✓
Erasing tracks
Why this is correct
Erasing tracks is a critical post-exploitation phase where an attacker systematically removes or alters forensic evidence of their presence and activities on a compromised system. This encompasses various anti-forensic techniques, including clearing system logs (e.g., Windows Event Logs, `auth.log`), modifying timestamps, deleting temporary files, and removing command history. Modifying log files directly falls under this comprehensive objective, aimed at hindering incident response and forensic investigations.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.