CEH Enumeration and System Hacking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Log manipulation

  Why it's wrong here

  Log manipulation involves modifying or deleting entries in system logs (e.g., /var/log/auth.log, /var/log/syslog) to remove evidence of an attacker's presence or actions. While crucial for post-exploitation cleanup and maintaining persistence by obscuring activity, it does not directly hide malicious binaries or processes from detection. Its purpose is to obscure the *record* of an event, not the *event source* itself, making it ineffective for concealing active malicious software.

• ✗

  Token impersonation

  Why it's wrong here

  Token impersonation is a Windows-specific privilege escalation technique where an attacker steals an authentication token from a privileged process or user session to execute commands with those elevated permissions. This method allows an attacker to bypass User Account Control (UAC) or gain SYSTEM-level access without cracking passwords. However, it is solely focused on privilege escalation and does not provide any mechanism for hiding malicious binaries, processes, or network connections on a compromised system.

• ✗

  Steganography

  Why it's wrong here

  Steganography is the art and science of hiding information within other non-secret data or media, such as images, audio files, or video. Its primary goal is to conceal the very existence of a message, making it appear as ordinary data. While it can be used to covertly exfiltrate data or deliver payloads, it does not directly hide an *active* malicious binary or its running process on a compromised Linux machine; it's about embedding data, not making an executable invisible to the operating system.

• ✓

  Rootkit installation via binary replacement

  Why this is correct

  Rootkit installation via binary replacement is a common and effective method for an attacker to maintain persistent access and hide their activities on a compromised Linux system. This technique involves replacing legitimate system binaries (e.g., `ls`, `ps`, `netstat`, `login`) with trojanized versions that execute their original function while simultaneously concealing malicious files, processes, or network connections. By subverting core system utilities, the rootkit can manipulate what the operating system reports, effectively making the attacker's presence invisible to standard monitoring tools.

Go deeper

Related to this question