CEH Enumeration and System Hacking Practice Question

An attacker has gained access to a system and wants to erase evidence of their activities. Which of the following actions is MOST effective for covering tracks on a Windows system?

⚠ Common exam trap

EC-Council often tests the distinction between covering tracks (erasing evidence) and maintaining access or evading detection; the trap here is that candidates confuse installing a rootkit (which hides ongoing activity) with clearing logs (which removes past evidence), leading them to choose B instead of C.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Clearing the Security event log

Clearing the Security event log (C) is the most effective action for covering tracks on a Windows system because it removes all logged security events, such as logon attempts, privilege use, and audit failures, which are the primary records that would reveal an attacker's activities. The Security log is maintained by the Windows Event Log service and is the default location for audit records under the Local Security Policy; deleting it eliminates forensic evidence of unauthorized access or changes.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Disabling the Windows Firewall
Why it's wrong here
Disabling the Windows Firewall primarily affects network traffic filtering, either allowing or blocking connections based on configured rules. While it might facilitate future unauthorized access by removing a defensive layer, it has no direct mechanism to delete or modify existing event logs, which are stored independently on the system's disk. Therefore, forensic analysis would still reveal previous attacker activities recorded in those logs.
✗
Installing a rootkit
Why it's wrong here
Installing a rootkit is a post-exploitation technique designed to maintain persistent access and conceal an attacker's presence by modifying core operating system functions. While a rootkit can hide files, processes, and network connections, or even prevent future logging of its activities, it does not inherently erase previously recorded security event logs that document the initial breach or earlier actions. The existing log entries remain intact, providing crucial forensic evidence.
✓
Clearing the Security event log
Why this is correct
Clearing the Security event log directly addresses the goal of erasing evidence because this log specifically records critical system events, including successful and failed login attempts, privilege escalations, object access, and other security-relevant actions. By deleting these entries, an attacker effectively removes the digital breadcrumbs that forensic investigators would use to reconstruct the timeline and nature of the intrusion. This action significantly hinders incident response and attribution efforts.
✗
Changing the administrator password
Why it's wrong here
Changing the administrator password grants the attacker exclusive control over the account for future access but does not retroactively remove any records of their prior activities or the initial compromise. While it secures future access for the attacker, the event logs would still contain entries detailing the original login, the password change itself, and any other actions performed before or during the modification. This action primarily affects future access, not past evidence.

Go deeper

CEH Enumeration and System Hacking Practice Question

Why each option matters

Option-by-option breakdown

Related to this question