CEH Enumeration and System Hacking Practice Question
Which THREE of the following are methods attackers use to cover their tracks after compromising a system?
⚠ Common exam trap
EC-Council often tests the distinction between attack phases, so candidates mistakenly associate dictionary attacks and vulnerability scanning with post-exploitation activities, when they actually belong to the enumeration and system hacking phases, not the covering tracks phase.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modifying file timestamps
Modifying file timestamps (A) is a common anti-forensic technique used to hide the evidence of file creation, modification, or access. Attackers use tools like `touch` on Linux or `SetFileTime` on Windows to alter the MAC (Modify, Access, Change) timestamps, making malicious files appear as legitimate system files. This prevents forensic investigators from identifying when the compromise occurred or which files were altered.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Modifying file timestamps
Why this is correct
Attackers utilize tools like `touch` on Linux or specialized utilities on Windows to meticulously alter the MAC (Modification, Access, Change) times of files and directories. This technique, known as timestomping, aims to blend malicious files with legitimate system files by making them appear older or newer than their actual creation or modification, thereby evading detection during forensic analysis and obscuring the true timeline of compromise or data exfiltration.
- ✓
Deleting event logs
Why this is correct
Attackers frequently clear security, system, and application event logs on compromised Windows systems using built-in utilities like `wevtutil` or custom scripts. On Linux, they might directly delete or truncate critical log files such as `/var/log/auth.log` or `/var/log/syslog`. This action is a crucial post-exploitation step designed to remove all traces of their presence, actions, and any errors generated, making it significantly harder for incident responders to reconstruct the attack timeline and identify persistence mechanisms.
- ✓
Installing a rootkit
Why this is correct
Rootkits are sophisticated collections of software tools specifically designed to conceal the existence of certain processes, files, network connections, or system data from standard operating system utilities. By modifying core OS components (kernel-mode rootkits) or user-mode libraries, they allow attackers to maintain persistent, undetected access and execute commands without revealing their activities to administrators or security software, effectively covering their tracks and ensuring long-term stealth.
- ✗
Performing a dictionary attack
Why it's wrong here
A dictionary attack is a method of attempting to gain unauthorized access to a password-protected system or service by systematically entering every word in an exhaustive list (dictionary) as a potential password. Its primary purpose is to crack credentials and achieve initial access, not to conceal or remove evidence of an attacker's presence or activities after a compromise has already occurred. Therefore, it is a pre-exploitation or initial access technique, not a method for covering tracks.
- ✗
Running a vulnerability scanner
Why it's wrong here
Running a vulnerability scanner, such as Nessus, OpenVAS, or Qualys, is a reconnaissance activity typically performed *before* or during the initial phases of an attack to identify potential weaknesses in target systems. Its goal is to discover exploitable flaws that can be leveraged to gain unauthorized access. This action actively generates network traffic and often leaves distinct log entries, making the attacker *more* visible, which is the direct opposite objective of covering tracks.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.