CEH Enumeration and System Hacking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Clearing event logs using wevtutil

  Why this is correct

  Clearing event logs using `wevtutil` is a direct method of covering tracks by eliminating forensic evidence. The `wevtutil` command-line utility allows an attacker to clear specific Windows Event Logs, such as Security, System, or Application logs, which record system activities, security events, and application errors. By removing these logs, an attacker can erase records of their login attempts, command executions, file accesses, and other malicious actions, significantly hindering incident response and forensic investigations.

• ✗

  Exploiting SUID binaries to gain root

  Why it's wrong here

  Exploiting SUID (Set User ID) binaries to gain root privileges is a technique primarily used for privilege escalation, not for covering tracks. SUID binaries allow a user to execute a program with the permissions of the file owner, typically root, enabling an attacker to gain higher access levels on a Unix-like system. While crucial for an attacker to achieve full control, this action itself does not conceal past activities or remove evidence of the attacker's presence; it merely elevates their current operational capabilities.

• ✓

  Installing a rootkit to hide malicious processes

  Why this is correct

  Installing a rootkit is a highly effective method for covering tracks as it actively hides an attacker's presence and activities from detection. A rootkit modifies the operating system's core functions or userland libraries to conceal malicious processes, files, network connections, and registry entries. By subverting standard system utilities and security software, rootkits make it extremely difficult for administrators or forensic tools to identify the attacker's continued persistence and operations on the compromised system.

• ✓

  Using timestomp to modify file timestamps

  Why this is correct

  Using timestomp to modify file timestamps is a valid technique for covering tracks by manipulating forensic artifacts. Timestomp allows an attacker to alter the Modification, Access, and Creation (MAC) timestamps of files on a compromised system. By changing these timestamps to match legitimate system files or to pre-date the intrusion, an attacker can make newly created or modified malicious files appear less suspicious, thereby blending them into the system and evading detection during forensic analysis.

• ✗

  Disabling Windows Defender via Group Policy

  Why it's wrong here

  Disabling Windows Defender via Group Policy is primarily a defense evasion technique rather than a method for covering tracks after compromise. This action prevents the security software from detecting ongoing or future malicious activity, allowing an attacker to operate with less risk of immediate detection. While it facilitates an attack, it does not retroactively remove evidence of past actions, delete logs, or conceal existing malicious artifacts, which are the core objectives of covering tracks.

Go deeper

Related to this question