CEH Enumeration and System Hacking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Installing a rootkit to hide files and processes

  Why this is correct

  Installing a rootkit is a sophisticated method for covering tracks, as a rootkit is a collection of tools designed to obtain and maintain privileged access to a computer while actively hiding its presence. By modifying core operating system components, rootkits can conceal malicious files, running processes, network connections, and even user accounts from standard system utilities and security software. This makes it extremely difficult for forensic investigators to detect the attacker's activities and persistence mechanisms, effectively covering their tracks post-compromise.

• ✗

  Escalating privileges to SYSTEM

  Why it's wrong here

  Escalating privileges to SYSTEM is a crucial phase in the attack lifecycle, allowing an attacker to gain full control over the compromised machine. This action is performed to achieve deeper access and execute further malicious activities, such as installing persistent backdoors or accessing sensitive data. However, it is an enabling step for the attack itself, not a method employed to conceal the attacker's presence or activities after the objective has been achieved.

• ✗

  Disabling antivirus software

  Why it's wrong here

  Disabling antivirus software is primarily an evasion technique used *during* the initial stages of an attack or when deploying malware to prevent detection and execution blocking. While it helps the attack succeed, it does not actively remove or obscure forensic evidence of the attacker's presence or actions *after* the compromise. Covering tracks involves cleaning up artifacts, not merely bypassing security controls to facilitate the initial intrusion or payload delivery.

• ✓

  Using steganography to hide stolen data in images

  Why this is correct

  Using steganography involves embedding secret information, such as exfiltrated data, within an ordinary, non-secret file or message, like an image or audio file. This technique allows attackers to covertly transfer stolen data out of a network without raising suspicion, as the carrier file appears innocuous. By making the data itself invisible within legitimate traffic, steganography effectively covers the tracks of data exfiltration, making it challenging to detect the compromise.

• ✓

  Clearing event logs

  Why this is correct

  Clearing event logs, such as Windows Security, System, and Application logs, is a fundamental and direct method for covering an attacker's tracks. These logs record critical system activities, including login attempts, process executions, and security events, which are invaluable for forensic analysis. By systematically deleting or tampering with these records, an attacker attempts to erase evidence of their presence, actions, and the timeline of the compromise, hindering detection and incident response efforts.

Go deeper

Related to this question