CEH Enumeration and System Hacking Practice Question
An incident responder finds that the Windows Event Logs on a compromised server have been cleared, and the Security log shows gaps in coverage. Additionally, a rootkit is suspected. Which phase of the hacking methodology does the clearing of logs represent?
⚠ Common exam trap
Test-takers frequently confuse 'Erasing tracks' with 'Privilege escalation' because clearing logs often requires administrative privileges, but the phase is defined by the intent to hide evidence, not the permission level used.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Erasing tracks
Clearing Windows Event Logs and creating gaps in the Security log is a classic post-exploitation step to remove forensic evidence of the attacker's actions. In the CEH hacking methodology, this falls under 'Erasing tracks' (also known as covering tracks), which is the final phase after maintaining access. The rootkit suspicion further supports this, as rootkits often include log-wiping or log-modification capabilities to hide their presence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Privilege escalation
Why it's wrong here
Privilege escalation is the process by which an attacker gains higher-level access rights on a system than initially obtained, such as moving from a standard user to an administrator account. This critical phase typically occurs *before* an attacker can perform actions like clearing logs, as elevated privileges are often required to manipulate system-level logging configurations. Therefore, log clearing is a subsequent post-exploitation action, not the act of escalating privileges itself, which focuses on gaining authority.
- ✗
Cracking passwords
Why it's wrong here
Cracking passwords involves the computational effort to discover plaintext credentials from their hashed or encrypted forms, often using techniques like dictionary attacks, brute-force, or rainbow tables. While successful password cracking can provide initial access or facilitate privilege escalation, it is a distinct activity focused on credential acquisition. Clearing event logs, conversely, is a forensic countermeasure designed to remove evidence of an attacker's presence and actions, not to obtain new credentials.
- ✓
Erasing tracks
Why this is correct
Erasing tracks, also known as covering tracks or anti-forensics, is a post-exploitation phase where an attacker attempts to remove or alter evidence of their presence and activities on a compromised system. Clearing Windows event logs is a quintessential example of this technique, as it directly eliminates critical forensic data that incident responders rely on to understand the attack timeline, methods, and scope. This action aims to hinder detection and attribution, making it significantly harder for security teams to reconstruct the incident.
- ✗
Executing applications
Why it's wrong here
Executing applications refers to the act of running specific programs, scripts, or commands on a compromised host to achieve various objectives, such as establishing persistence, exfiltrating data, or deploying additional malware. While an attacker might execute a command-line utility or script to clear event logs, the *act* of clearing logs is the objective of evidence removal, not merely the execution of a program itself as a primary attack goal. The execution is the *method*, while erasing tracks is the *purpose*.
Go deeper
Related to this question
Learn chapter
Introduction to Ethical Hacking
Key term
Persistence Mechanisms
Techniques used by attackers to maintain long-term access to a compromised system after an initial breach.
Key term
Nmap Scanning
Nmap scanning is a method used to discover devices running on a network and find open ports, services, and security weaknesses.
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.