CEH Enumeration and System Hacking Practice Question

In the context of system hacking methodology (CHPSET), which phase involves hiding malicious files from the operating system and security tools using techniques such as NTFS alternate data streams (ADS) or steganography?

⚠ Common exam trap

Test-takers frequently confuse 'hiding files' with 'erasing tracks' (Option B) in the EC-CEH methodology, as both involve evasion, but erasing tracks focuses on log and evidence removal, not file concealment via ADS or steganography.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Hiding files

The 'Hiding files' phase of the CHPSET (Cracking, Hacking, Privilege escalation, Spying, Erasing tracks, Hiding files) methodology specifically involves concealing malicious files from the OS and security tools. Techniques like NTFS alternate data streams (ADS) allow data to be stored in a file's metadata stream (e.g., type echo payload > file.txt:stream) without affecting the visible file size, while steganography hides data within images or audio files. This phase occurs after gaining access and before covering tracks.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Privilege escalation
Why it's wrong here
Privilege escalation is a critical step where an attacker attempts to gain higher-level access permissions on a compromised system, moving from a standard user to an administrator or root user. This process is distinct from hiding files, as it focuses on increasing operational control rather than concealing artifacts. While successful escalation might enable the hiding of files, it is a prerequisite action, not the act of concealment itself.
✗
Erasing tracks
Why it's wrong here
Erasing tracks involves the meticulous removal or alteration of forensic evidence, such as system logs, command histories, and timestamps, to obscure an attacker's presence and activities. This post-exploitation phase aims to prevent detection and attribution by security analysts. Unlike hiding files, which focuses on concealing specific malicious payloads or backdoors, erasing tracks is about sanitizing the system's audit trails to make the intrusion appear as if it never happened.
✓
Hiding files
Why this is correct
Hiding files is a crucial post-exploitation activity within the system hacking methodology, designed to conceal malicious tools, backdoors, rootkits, or exfiltrated data on a compromised system. This action ensures the attacker's continued access and persistence by making their presence difficult for defenders to detect through standard system monitoring. It is a fundamental technique for maintaining a covert foothold and preventing the discovery of persistent mechanisms.
✗
Cracking passwords
Why it's wrong here
Cracking passwords is typically an initial access or privilege escalation technique, involving the recovery of plaintext passwords from hashed credentials or brute-forcing login attempts. This process aims to gain legitimate user credentials to access systems or services, often occurring early in the 'Gaining Access' phase of an attack. It is fundamentally different from hiding files, as cracking focuses on obtaining authentication details rather than concealing artifacts post-compromise.

Go deeper

CEH Enumeration and System Hacking Practice Question

Why each option matters

Option-by-option breakdown

Related to this question