Certified Ethical Hacker CEH (CEH) — Questions 301–375

XML External Entity (XXE) injection is the correct vulnerability because the provided payload explicitly defines an external entity within the DOCTYPE declaration. By referencing "file:///etc/passwd" via the SYSTEM identifier, the XML parser is instructed to retrieve the content of the specified local file. This content is then processed and potentially returned in the application's response, confirming the successful exploitation of the XML parser's ability to resolve external entities.

The -f flag instructs Nmap to fragment the probe packets into smaller pieces, typically 8 bytes or less, before sending them. This technique can bypass stateless firewalls or basic Intrusion Detection Systems (IDS) that only inspect the first fragment of a packet or fail to reassemble fragmented packets correctly. By splitting the TCP header across multiple fragments, it becomes harder for security devices to identify the true nature of the scan, making it a common evasion tactic.

This is spear phishing because the email is crafted specifically for that employee, using the CEO's identity to add urgency and authority. The targeted nature and the spoofed email address are hallmarks of spear phishing.

The -f (or --fragment) flag instructs Nmap to fragment the IP packets it sends into several smaller pieces. This technique is specifically designed to evade simple packet filters and intrusion detection systems (IDS) that might inspect only the first fragment of a packet or have difficulty reassembling fragmented packets correctly. By splitting the TCP or UDP header across multiple fragments, it can bypass rules that look for specific header information in a single, complete packet, thus aiding in stealth.

`enum4linux` is a wrapper script designed specifically for enumerating information from Windows and Samba hosts via NetBIOS and SMB. It leverages underlying tools like `rpcclient`, `net`, and `nmblookup` to extract a wide array of details. This includes user lists, group memberships, share names, password policies, and operating system information, making it highly effective for comprehensive SMB enumeration attempts.

PrintNightmare (CVE-2021-34527) is a critical remote code execution vulnerability affecting the Windows Print Spooler service, enabling attackers to execute arbitrary code with SYSTEM privileges. This vulnerability was publicly disclosed and subsequently patched in July 2021. Since the exhibited patch dates for the system only extend through 2020, the required security update for PrintNightmare would not have been applied, making it a relevant and unpatched vulnerability.

Modifying the "Referer" header is a direct test for Cross-Site Request Forgery (CSRF) defenses. Many web applications implement CSRF protection by validating the "Referer" header to ensure that a request originates from the application's own domain. A penetration tester's action of altering this header directly attempts to bypass or evaluate the robustness of such "Referer"-based validation mechanisms, simulating an attacker's attempt to circumvent this common CSRF mitigation.

After discovering AWS access keys, the immediate and most prudent step is to validate their authenticity and determine the associated identity using sts:GetCallerIdentity. This API call confirms the keys are active and reveals the IAM user or role they belong to. Following this, enumerating the permissions attached to that identity via IAM policies is critical to understand the full scope of access, identify potential escalation paths, and discover other high-value targets within the AWS environment.

This option accurately describes the idle scan's core methodology. The attacker first probes an idle "zombie" host to record its current IPID (IP Identification field). Subsequently, the attacker sends spoofed SYN packets to the target, using the zombie's IP address as the source. If the target port is open, it responds with a SYN-ACK to the zombie, causing the zombie to send an RST to the target and increment its IPID. If the target port is closed, it responds with an RST to the zombie, which does not increment the zombie's IPID. A final probe to the zombie reveals whether its IPID has incremented, indicating an open port on the target.

Masscan is purpose-built for extremely high-speed network scanning, capable of transmitting millions of packets per second across the internet. It achieves this unparalleled speed by employing a custom, asynchronous TCP/IP stack and operating in a stateless manner, primarily focusing on rapid port discovery rather than detailed service enumeration. This design allows it to scan the entire IPv4 address space for specific ports in mere minutes, making it ideal for large-scale reconnaissance and vulnerability mapping.

Erasing tracks is the crucial final phase in the system hacking methodology, where an attacker meticulously removes all forensic evidence of their presence and activities from a compromised system. This involves clearing system logs, modifying file timestamps, deleting malicious tools, and altering audit trails to prevent detection by security analysts and incident responders. The objective is to maintain persistence and avoid attribution, making it appear as if no intrusion occurred.

Implementing CSRF tokens is the standard and most effective defense against Cross-Site Request Forgery attacks. A unique, unpredictable token is generated by the server for each user session and embedded within forms or request headers. The server then validates this token upon receiving a request; if the token is missing or incorrect, the request is rejected, preventing an attacker from forging requests that originate from a different site without knowledge of the valid token. This mechanism ensures that only requests originating from the legitimate application are processed.

Password spraying uses a few common passwords across many accounts.

The application fetches a user-supplied URL server-side without validation, enabling an attacker to craft a request to the internal AWS metadata endpoint at 169.254.169.254. This SSRF attack exploits the lack of input sanitisation to retrieve instance metadata, such as IAM credentials, because the server trusts its own network context. The stem’s constraint—unvalidated server-side URL fetching—directly enables this attack vector.

Symmetric encryption algorithms, such as AES or DES, fundamentally rely on a singular, identical secret key for both the transformation of plaintext into ciphertext and the subsequent reversal of ciphertext back into plaintext. This shared secret must be securely exchanged between communicating parties prior to any encrypted data transmission. The efficiency of this method stems from using the same cryptographic key for both operations, simplifying key management for individual sessions.

This is the correct answer because mounting the Docker socket (`/var/run/docker.sock`) inside a container grants the container full administrative control over the host's Docker daemon. An attacker can leverage this access to execute Docker commands, such as `docker run -v /:/host_root -it ubuntu bash`, which effectively mounts the host's root filesystem into a new container, thereby achieving a complete container escape and gaining arbitrary command execution capabilities on the host system.

ARP poisoning causes multiple MAC entries for one IP due to forged ARP replies.

Static analysis, particularly utilizing tools like `strings` and PEiD, is the safest and most appropriate initial step for examining a suspicious executable without execution. The `strings` utility can extract human-readable text from the binary, revealing potential commands, URLs, or error messages that often indicate malicious intent. PEiD (PE Identifier) helps analysts identify the compiler, packer, or cryptor used, which is crucial for understanding obfuscation techniques and guiding further analysis, all while minimizing risk.

XML External Entity (XXE) injection occurs when an XML parser processes XML input containing a reference to an external entity without proper validation. This vulnerability allows an attacker to define custom entities that can reference local files, network resources, or even execute commands, leading to the disclosure of sensitive data, denial-of-service, or server-side request forgery. The ability to read local files directly via the XML parser is a hallmark of XXE.

The PUT method is the designated HTTP verb for uploading files in WebDAV because it requests that the enclosed entity be stored under the supplied Request-URI. If the URI refers to an existing resource, PUT replaces it; if the URI does not point to an existing resource, the server creates it. This idempotent behavior, where repeated identical requests have the same effect as a single request, makes PUT ideal for creating or updating files directly at a specified location.

Implementing prepared statements with parameterized queries is the most robust solution because it fundamentally separates SQL code from user-supplied data. The database engine first compiles the SQL query structure, defining placeholders for input, before any user data is introduced. Subsequently, user input is bound to these placeholders as literal values, ensuring it is never interpreted as executable SQL code, thereby eliminating the possibility of SQL injection attacks.

A Decoy scan, initiated with the -D flag, is a technique used to obfuscate the true source IP address of the scanner by interspersing it with multiple decoy IP addresses. When RND:10 is used, Nmap generates 10 random, non-existent IP addresses (or existing ones if specified) and sends scan packets from these decoys, along with the actual scanner's IP. This makes it challenging for intrusion detection systems (IDS) or firewall logs to pinpoint the actual origin of the scan amidst the noise generated by the decoys.

Rootkit installation via binary replacement is a common and effective method for an attacker to maintain persistent access and hide their activities on a compromised Linux system. This technique involves replacing legitimate system binaries (e.g., `ls`, `ps`, `netstat`, `login`) with trojanized versions that execute their original function while simultaneously concealing malicious files, processes, or network connections. By subverting core system utilities, the rootkit can manipulate what the operating system reports, effectively making the attacker's presence invisible to standard monitoring tools.

Hashcat is the industry-standard password recovery tool, renowned for its unparalleled speed and efficiency in cracking various hash types, including NTLM, through highly optimized GPU-accelerated brute-force and dictionary attacks. Its ability to leverage modern graphics cards allows it to test billions of password candidates per second, making it the most effective choice for rapidly cracking password dumps obtained during a penetration test.

WebDAV provides HTTP methods like PUT and MKCOL, enabling clients to upload and manage files on the server. If WebDAV is enabled with write permissions and the server is misconfigured to allow execution of uploaded files (e.g., ASP, ASPX, PHP, or even compiled executables) within a web-accessible directory, an attacker can upload a malicious web shell or other executable code. Subsequently accessing this uploaded file through the web server will trigger its execution, granting the attacker remote code execution capabilities on the server.

When Nmap reports a port as "filtered," it means that the Nmap probe packets (e.g., SYN for TCP, ICMP for UDP) reached the target, but no response was received from the target host. This behavior is characteristic of a firewall, either host-based or network-based, configured to silently drop incoming traffic without sending an RST packet (for TCP) or an ICMP Port Unreachable message (for UDP). Such silent drops prevent Nmap from determining the port's true state (open or closed), leading to the "filtered" classification.

This statement is correct. The "SameSite" attribute is designed to prevent a browser from sending a cookie with requests initiated from a different origin than the site that set the cookie. By restricting the automatic inclusion of session cookies in cross-origin requests, it significantly mitigates Cross-Site Request Forgery (CSRF) attacks, where an attacker tricks a user's browser into sending an authenticated request to a vulnerable web application without their explicit consent. This defense ensures that sensitive actions require a same-site context.

Ophcrack is a specialized, open-source password cracker specifically designed for Windows LM and NTLM hashes, making it the correct tool for this task. It excels by employing precomputed rainbow tables, which are large datasets of hash chains, to quickly reverse the hashing process for these particular Windows authentication hashes. This method significantly reduces the time required to find the original password compared to traditional brute-force attacks, especially for weaker LM hashes.

Port scanning with Nmap is a quintessential active reconnaissance technique because it involves sending specially crafted packets directly to a target host. Nmap probes specific TCP or UDP ports to determine their state (open, closed, filtered) and identify running services. This direct interaction generates network traffic that the target's firewalls or intrusion detection systems can log, making it detectable and undeniably active.

Static analysis involves dissecting malware binaries without executing them, examining the code, structure, and embedded resources. This process often includes disassembling or decompiling the executable, extracting strings, analyzing PE headers, and identifying imported/exported functions to infer potential malicious capabilities. Its primary goal is to understand the malware's design, identify obfuscation techniques, and predict its behavior before it ever runs, providing crucial initial insights into its functionality.

Deploying a scrubbing center is a highly effective strategy for mitigating DDoS attacks, particularly those involving high-volume UDP floods. These specialized facilities act as an intermediary, diverting all incoming traffic through advanced analysis systems that inspect packet headers and payloads for known attack patterns and anomalies. Malicious traffic is then filtered out, while legitimate requests are forwarded to the organization's infrastructure, ensuring business continuity without disrupting genuine user access.

MAC flooding fills the switch's MAC address table, causing it to broadcast frames.

Cain & Abel is a well-known password recovery and network sniffing tool primarily designed for Microsoft Windows operating systems. Among its extensive features, it specifically incorporates robust ARP poisoning functionalities, allowing an attacker to perform Man-in-the-Middle (MITM) attacks by sending forged ARP replies to redirect network traffic. This enables the interception of data, including credentials, between targeted hosts on a local area network.

A ping sweep, also known as an ICMP sweep, is a highly efficient and low-traffic method for host discovery that involves sending ICMP echo request packets to a range of IP addresses. Any host that is live and configured to respond to ICMP will send an ICMP echo reply packet back to the sender. The receipt of these replies reliably indicates the presence of an active host on the network, making it a foundational and quick technique for initial network reconnaissance.

Stored procedures, when implemented with parameterized inputs, offer a robust defense against SQL injection. By pre-compiling the SQL statements on the database server, they ensure that user-supplied data is treated strictly as data values, not executable code. This separation prevents malicious input from altering the intended query logic, effectively neutralizing injection attempts before execution.

This approach leverages a common file upload vulnerability bypass technique. By using a '.phtml' extension, which Apache servers often interpret as PHP, the attacker can circumvent typical blacklist filters that block '.php' files. Once uploaded to an accessible directory like '/uploads/', the web shell can be requested, allowing the attacker to execute arbitrary commands on the server, achieving remote code execution.

Fragmentation can help evade detection by splitting the SYN packet across multiple fragments.

A Downgrade attack specifically involves an attacker actively manipulating the TLS handshake process between a client and server. The attacker forces the communication parties to negotiate and use an older, less secure protocol version or weaker cipher suite than they would normally prefer or support. This significantly reduces the cryptographic strength of the session, making it easier for the attacker to decrypt intercepted data.

Server-Side Request Forgery (SSRF) occurs when a web application is coerced into making requests to an arbitrary domain specified by the attacker, often to internal systems or services that are not directly accessible from the internet. By manipulating a user-supplied URL parameter, an attacker can trick the vulnerable server into fetching data from internal network resources, cloud metadata APIs, or other services, thereby exposing sensitive information or enabling further attacks. This directly matches the scenario described.

The `dnsrecon` tool, when used with the `-d` flag, attempts to perform a zone transfer (AXFR) from the specified domain's DNS servers. A successful execution, as implied by the question context, indicates that the DNS server is configured to permit full zone transfers to any requesting host, including unauthorized external entities. This represents a significant security misconfiguration, as it exposes sensitive network topology and host information.

A polymorphic virus is specifically designed to evade detection by antivirus software through continuous modification of its own code. Each new infection generates a unique, encrypted version of the virus body, coupled with a varying decryption routine. This constant mutation of its signature makes it extremely challenging for traditional signature-based detection systems to identify and quarantine, directly aligning with the characteristic of modifying its own code.

Whaling is a highly targeted form of phishing specifically aimed at senior executives, C-level management, or other high-profile individuals within an organization. These attacks are meticulously crafted and personalized, often leveraging publicly available information to create convincing emails that appear to come from a legitimate, trusted source, such as a legal firm or a high-ranking internal contact. The objective is typically to trick the executive into authorizing large wire transfers, revealing sensitive corporate data, or granting access to critical systems. The scenario describes an email likely targeting a high-level individual, making whaling the most precise classification.

This dork effectively leverages the `inurl:` operator, which specifically restricts search results to pages where the specified keyword appears within the URL string. By combining `inurl:"admin"` and `inurl:"login"`, the search precisely targets web pages that contain both "admin" and "login" within their URL paths. This combination is highly effective for identifying administrative login interfaces, as these keywords frequently appear together in the URLs of such sensitive portals.

A sandbox provides a secure, isolated environment where suspicious binaries can be executed and observed without risking the host system. It meticulously records all dynamic behaviors, including file system modifications, registry changes, network connections, process injections, and API calls. This controlled execution allows security analysts to understand the malware's true intent and operational capabilities in real-time.

Slowloris is an application-layer attack that consumes server resources by keeping many connections open.

Dynamic analysis involves executing the malware within a controlled, isolated environment, such as a sandbox or virtual machine, to observe its real-time behavior. This method allows forensic analysts to meticulously document system changes, process interactions, file modifications, and network communications initiated by the malicious code as it runs. It is crucial for understanding the full operational impact and capabilities of sophisticated threats.

Ophcrack is a dedicated and highly effective password cracker specifically designed to recover Windows LM and NTLM hashes by leveraging precomputed rainbow tables. It comes with pre-generated tables optimized for these hash types, allowing for very fast lookups and password recovery, even from live systems or SAM files. Its primary strength lies in its specialized focus and efficient implementation of rainbow table technology for Windows authentication credentials.

ScoutSuite's core functionality involves programmatically fetching extensive configuration data from various cloud services, including AWS S3, EC2, IAM, and Security Groups, through API interactions. It then meticulously analyzes this collected data against a robust set of predefined security best practices and compliance benchmarks. This process culminates in a comprehensive, human-readable report highlighting critical misconfigurations such as publicly exposed storage buckets, overly permissive IAM policies, unencrypted resources, or unpatched instances, thereby providing a clear overview of the cloud environment's security posture.

Exploiting kernel vulnerabilities to gain root.

Uses a wordlist to guess passwords.

Implementing client-side certificate validation for network authentication is a robust countermeasure because it mandates that the client verify the identity of the access point (AP) using a pre-installed, trusted digital certificate. If a rogue AP, such as an evil twin, attempts to impersonate the legitimate network, it will lack the correct certificate, causing the client to reject the connection and preventing users from inadvertently connecting to the malicious network.

A UDP flood attack involves sending a high volume of User Datagram Protocol (UDP) datagrams to random high-numbered ports on a target server. The server then attempts to identify which application, if any, is listening on each port. When no application is found, the server typically generates an ICMP "Destination Unreachable" packet in response. This continuous process consumes significant server resources, including CPU cycles and outgoing network bandwidth, leading to service degradation or denial for legitimate users, precisely matching the described scenario.

A local exploit in a service directly targets vulnerabilities within a running Windows service, such as the Print Spooler. These services often operate with elevated privileges, like SYSTEM, and a successful exploit can allow an attacker to execute arbitrary code with those higher permissions. This method directly leverages a flaw in the service's code or configuration to escalate privileges from a low-privileged user account. PrintNightmare is a prime example, exploiting a vulnerability in the Print Spooler service to achieve SYSTEM-level access.

Reflected Cross-Site Scripting, or Non-Persistent XSS, occurs when a malicious script, often embedded in a URL parameter, is immediately returned by the web server in its HTTP response without proper sanitization. The browser then interprets and executes this unsanitized script as part of the legitimate page content. The payload "><script>alert('XSS')</script>" is characteristic of a reflected attack, designed to break out of an HTML context and execute client-side code upon immediate reflection.

When dnsrecon is executed with only the domain specified, such as dnsrecon -d example.com, its default behavior is to attempt a DNS zone transfer (AXFR). This process requests a full copy of the DNS zone file from the authoritative name server. If the server is misconfigured to allow unauthorized zone transfers, the tester can obtain a comprehensive list of all hostnames, IP addresses, and other DNS records for the domain, providing extensive reconnaissance data.

Disabling recursion on DNS servers for external queries is the most effective direct mitigation against DNS amplification attacks. By configuring a DNS server to only perform recursive lookups for internal, trusted clients and to only respond authoritatively for its own zones to external requests, it prevents the server from acting as an open recursive resolver. This crucial configuration change eliminates the server's ability to be exploited by attackers to amplify small queries into large responses directed at a victim, thereby removing it as a participant in such attacks.

Time-based SQL injection is the correct answer because the scenario explicitly describes inferring information based on *timing differences* in the web application's response. This technique is employed when direct error messages or content changes are not visible to the attacker. Attackers inject SQL queries containing database-specific time-delay functions (e.g., SLEEP() in MySQL, WAITFOR DELAY in MS SQL Server) within a conditional statement. If the injected condition evaluates to true, the database pauses for a specified duration, causing a noticeable delay in the application's response, thereby confirming the truthfulness of the condition and allowing data exfiltration character by character.

Hashcat is the industry-standard password recovery tool, highly optimized for cracking NTLM hashes due to its unparalleled support for GPU acceleration. It efficiently leverages modern graphics cards to perform millions of guesses per second, significantly reducing cracking time. Furthermore, Hashcat offers a wide array of attack modes, including dictionary, brute-force, mask, and sophisticated hybrid attacks, making it exceptionally versatile and fast for obtaining NTLM hashes.

This statement accurately describes how SameSite=Strict thwarts a CSRF attempt. When a user visits a malicious website, and that site tries to forge a request to the banking application, the browser recognizes this as a cross-origin request. Because the banking application's session cookie is configured with SameSite=Strict, the browser will deliberately omit this crucial authentication cookie from the outgoing request, rendering the forged request unauthenticated and ineffective.

Adware is specifically designed to generate revenue by displaying unsolicited advertisements, often in the form of pop-up windows, banners, or browser redirects. This constant barrage of ads, coupled with the background processes required to deliver them, significantly consumes system resources like CPU, RAM, and network bandwidth. Consequently, users experience a noticeable degradation in system performance, manifesting as general slowness and unresponsiveness, directly aligning with the reported symptoms.

Cross-Site Scripting (XSS) via uploaded file occurs when an attacker uploads malicious client-side script, typically JavaScript, to a web-accessible resource like a public AWS S3 bucket. If the bucket is configured to serve the file with an executable Content-Type (e.g., text/html or application/javascript) and a user's browser accesses this file directly, the script executes within the user's browser context. This allows the attacker to steal session cookies, deface the page, or redirect users, leveraging the trust in the S3 domain.

MAC flooding makes the switch act like a hub, forwarding all frames to all ports.

The intitle:login Google Dork is highly effective for pinpointing potential login pages because web developers commonly include "login" or "sign in" within the HTML <title> tag of authentication portals. This query directly targets the descriptive title of a page, significantly increasing the likelihood of identifying an actual user authentication interface rather than general administrative content or unrelated pages. It provides a direct indicator of a page designed for user credential submission.

The `nbtstat -a <IP_address>` (or `-A`) command is precisely used to perform a NetBIOS name table lookup of a remote host. This command queries the specified IP address for its registered NetBIOS names, which can reveal crucial information such as the computer's hostname, workgroup or domain membership, and potentially the username of the currently logged-on user, aiding in initial reconnaissance.

TCP session hijacking is an attack where a malicious actor takes control of an already established TCP session between two legitimate communicating parties. By successfully predicting the next valid TCP sequence number, the attacker can inject their own packets into the data stream, impersonating one of the legitimate hosts. This allows the attacker to send commands, receive data, or terminate the session, effectively seizing control without needing to authenticate.

An MX (Mail Exchanger) record specifies the mail servers responsible for accepting email messages on behalf of a domain, along with their preference values. During a DNS zone transfer, obtaining MX records provides highly valuable intelligence about an organization's email infrastructure, including the hostnames and sometimes internal IP addresses of their mail servers. This information is critical for penetration testers, as it identifies prime targets for email-based attacks, spoofing, or further reconnaissance against mail gateways and associated systems.

Configuring port security on switches is an effective technique because it limits the number of MAC addresses that can be learned on a specific switch port. By restricting a port to a single, legitimate MAC address or a small, defined set, it prevents an attacker from introducing a new, spoofed MAC address to impersonate another device or the gateway, thereby mitigating ARP poisoning attempts that rely on MAC address changes.

Pretexting involves the creation of a convincing, fabricated scenario or "pretext" to manipulate a target into revealing confidential information or performing a specific action. In this type of social engineering engagement, the attacker constructs a plausible backstory, such as impersonating IT support or a vendor, to establish trust and extract desired details directly from the target over the phone. This method precisely aligns with an attacker calling someone with a specific, made-up story to achieve their objective.

Ettercap is a comprehensive suite specifically designed for performing man-in-the-middle (MITM) attacks on local area networks, with a core specialization in ARP spoofing (also known as ARP poisoning). It actively manipulates the ARP tables of target hosts and the network gateway by sending forged ARP replies, redirecting traffic through the attacker's machine. This capability enables various MITM activities, including sniffing, content filtering, and session hijacking, making it the ideal tool for actively performing such an attack during a penetration test.

ARP spoofing, also known as ARP poisoning, is a man-in-the-middle (MitM) attack where an attacker sends forged Address Resolution Protocol (ARP) messages over a local area network. The attacker's goal is to associate their own MAC address with the IP address of another host, such as the default gateway, or to associate the gateway's MAC address with the victim's IP. By doing so, the attacker intercepts network traffic intended for other devices, as the traffic is incorrectly routed through the attacker's machine, allowing for eavesdropping, modification, or redirection. This directly involves manipulating ARP packets to link a single MAC address to multiple IP addresses or vice-versa within the victim's ARP cache.

Session hijacking is the act of taking control of an already authenticated TCP session between two communicating parties. This is typically achieved by an attacker successfully predicting or sniffing the correct TCP sequence numbers (acknowledgment and sequence numbers) that the legitimate client and server expect. By injecting packets with the correct sequence numbers, the attacker can impersonate the client or server, effectively taking over the session and issuing commands or receiving data without the original client's knowledge.

Ettercap is a comprehensive suite designed specifically for man-in-the-middle (MITM) attacks on local area networks, including robust ARP poisoning capabilities. It actively intercepts traffic by sending forged ARP replies to trick hosts into associating the attacker's MAC address with the gateway's IP, and vice-versa. This allows the penetration tester to transparently relay, inspect, and modify network traffic between the target and the gateway, fulfilling the requirement for ARP poisoning.

Implementing a mantrap at the entrance is the most effective defense because it is a physical security mechanism designed specifically to prevent tailgating. A mantrap consists of two interlocking doors, where the first door must close and lock before the second door can open, typically allowing only one person to pass through at a time after successful authentication. This physically enforces single-person entry, making it virtually impossible for a second individual to follow an authorized person into a restricted area.

wevtutil cl clears the specified event log.