CEH Enumeration and System Hacking Practice Question
An attacker modifies system logs to remove entries related to their activities. Which technique is being used to cover tracks?
⚠ Common exam trap
Many exam-takers confuse rootkit installation with log manipulation, as rootkits can hide logs, but the question specifically asks about modifying logs to remove entries, which is a direct action on the log files themselves, not a hiding mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Log manipulation
Log manipulation is the correct answer because it directly involves altering or deleting log entries to hide evidence of unauthorized activities. Attackers often use this technique to remove traces of their actions from system logs, such as event logs in Windows or syslog files in Linux, thereby covering their tracks and avoiding detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Token impersonation
Why it's wrong here
Token impersonation is a post-exploitation technique where an attacker obtains a user's security token to assume their identity and privileges, often for privilege escalation or lateral movement. This involves leveraging existing authentication sessions or creating new ones with stolen credentials, allowing the attacker to execute commands or access resources as the impersonated user. It does not directly describe the act of modifying system logs.
- ✗
Steganography
Why it's wrong here
Steganography is the practice of concealing a file, message, image, or video within another file, message, image, or video to hide its existence. Its primary purpose is covert communication, making it difficult for an observer to detect the presence of the hidden information. This technique focuses on hiding data within other data, rather than directly altering or deleting entries in system log files.
- ✓
Log manipulation
Why this is correct
Log manipulation precisely describes the act of an attacker altering, deleting, or fabricating entries within system logs to obscure their malicious activities. This technique is crucial for covering tracks, evading detection by security monitoring systems, and hindering forensic investigations by removing evidence of unauthorized access or actions. Modifying log files directly addresses the scenario of removing specific entries.
- ✗
Rootkit installation
Why it's wrong here
A rootkit is a collection of malicious software tools designed to enable continued privileged access to a computer while actively hiding its presence from administrators and security software. While a rootkit might include capabilities for log manipulation to maintain stealth, its core definition pertains to persistent, hidden access at a low level within the operating system. The question specifically describes the action of modifying logs, not the broader installation of a hidden access mechanism.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.