CEH Enumeration and System Hacking Practice Question
An attacker has gained access to a Linux server and wants to cover their tracks. They edit the `.bash_history` file, modify system logs in `/var/log`, and install a kernel module that hides their processes. Which two steps of the system hacking methodology (CHPSET) are being performed?
⚠ Common exam trap
Test-takers frequently confuse 'Erasing tracks' with 'Covering tracks' (they are the same step) and failing to recognize that installing a kernel module to hide processes is a spying/monitoring activity, not privilege escalation or executing applications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Erasing tracks and Spying
The attacker is performing 'Erasing tracks' by editing .bash_history and modifying logs in /var/log, and 'Spying' by installing a kernel module to hide processes, which allows continued covert monitoring. These correspond to the 'Erasing tracks' and 'Spying' steps in the CHPSET (Cracking, Hacking, Privilege escalation, Spying, Executing applications, Erasing tracks) methodology.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Erasing tracks and Privilege escalation
Why it's wrong here
While "Erasing tracks" aligns with cleaning logs and history, the term "Privilege escalation" is incorrectly applied here. The scenario states the attacker "has gained access," implying initial compromise is complete. Privilege escalation typically involves gaining higher-level permissions (e.g., root from a standard user) *after* initial access, which is not explicitly described as an action the attacker is currently performing or attempting in this context. The focus is on post-access activities, not gaining further privileges.
- ✗
Cracking passwords and Covering tracks
Why it's wrong here
The option "Cracking passwords" is not supported by the described actions; cleaning logs and installing a kernel module do not involve password cracking. Password cracking is usually an initial access technique or a method to gain access to other systems, not a direct outcome of the actions mentioned. While "Covering tracks" is a broad category that includes erasing evidence and maintaining stealth, the inclusion of "Cracking passwords" makes this option inaccurate for the given scenario.
- ✓
Erasing tracks and Spying
Why this is correct
"Erasing tracks" accurately describes the act of cleaning logs and command history, which are critical steps for an attacker to remove evidence of their presence and activities on a compromised system. Simultaneously, "Spying" precisely characterizes the installation of a kernel module designed to hide processes. This module enables the attacker to maintain a stealthy, persistent foothold, allowing for undetected monitoring and control, effectively 'spying' on the system's operations without revealing their malicious presence.
- ✗
Executing applications and Spying
Why it's wrong here
While the kernel module's function does contribute to "Spying" by hiding processes, the term "Executing applications" is not the most precise description of the attacker's actions. Installing a kernel module is a specific, low-level system modification for persistence and stealth, rather than merely running user-space applications. The primary intent of such a module is to conceal the attacker's activities and maintain access, which falls more squarely under spying and maintaining persistence than general application execution.
Go deeper
Related to this question
Learn chapter
Introduction to Ethical Hacking
Key term
Covering Tracks
Covering tracks is the process attackers use to hide their activity and remove evidence of a security breach after gaining unauthorized access to a system.
Key term
Privilege escalation
Privilege escalation is when a user or attacker gains more access or control over a system than they are supposed to have.
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.