Common Covering Tracks Techniques
Which THREE of the following are valid techniques for covering tracks after compromising a system? (Select 3 correct answers)
⚠ Common exam trap
EC-Council often tests the distinction between privilege escalation (gaining higher access) and covering tracks (hiding evidence), causing candidates to mistakenly select SUID exploitation as a track-covering technique.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Clearing event logs using wevtutil
A is correct because wevtutil is a Windows command-line utility used to manage event logs. After compromising a system, an attacker can use 'wevtutil cl' followed by a log name (e.g., 'wevtutil cl System') to clear specific event logs, thereby erasing evidence of their activities. This is a direct and common technique for covering tracks by removing forensic artifacts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Clearing event logs using wevtutil
Why this is correct
Clearing event logs using `wevtutil` is a direct method of covering tracks by eliminating forensic evidence. The `wevtutil` command-line utility allows an attacker to clear specific Windows Event Logs, such as Security, System, or Application logs, which record system activities, security events, and application errors. By removing these logs, an attacker can erase records of their login attempts, command executions, file accesses, and other malicious actions, significantly hindering incident response and forensic investigations.
- ✗
Exploiting SUID binaries to gain root
Why it's wrong here
Exploiting SUID (Set User ID) binaries to gain root privileges is a technique primarily used for privilege escalation, not for covering tracks. SUID binaries allow a user to execute a program with the permissions of the file owner, typically root, enabling an attacker to gain higher access levels on a Unix-like system. While crucial for an attacker to achieve full control, this action itself does not conceal past activities or remove evidence of the attacker's presence; it merely elevates their current operational capabilities.
- ✓
Installing a rootkit to hide malicious processes
Why this is correct
Installing a rootkit is a highly effective method for covering tracks as it actively hides an attacker's presence and activities from detection. A rootkit modifies the operating system's core functions or userland libraries to conceal malicious processes, files, network connections, and registry entries. By subverting standard system utilities and security software, rootkits make it extremely difficult for administrators or forensic tools to identify the attacker's continued persistence and operations on the compromised system.
- ✓
Using timestomp to modify file timestamps
Why this is correct
Using timestomp to modify file timestamps is a valid technique for covering tracks by manipulating forensic artifacts. Timestomp allows an attacker to alter the Modification, Access, and Creation (MAC) timestamps of files on a compromised system. By changing these timestamps to match legitimate system files or to pre-date the intrusion, an attacker can make newly created or modified malicious files appear less suspicious, thereby blending them into the system and evading detection during forensic analysis.
- ✗
Disabling Windows Defender via Group Policy
Why it's wrong here
Disabling Windows Defender via Group Policy is primarily a defense evasion technique rather than a method for covering tracks after compromise. This action prevents the security software from detecting ongoing or future malicious activity, allowing an attacker to operate with less risk of immediate detection. While it facilitates an attack, it does not retroactively remove evidence of past actions, delete logs, or conceal existing malicious artifacts, which are the core objectives of covering tracks.
Go deeper
Related to this question
About these practice questions
One of 913 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE of the following are methods for covering tracks after compromising a system? (Select 3)
hard- ✓ A.Installing a rootkit to hide files and processes
- B.Escalating privileges to SYSTEM
- C.Disabling antivirus software
- ✓ D.Using steganography to hide stolen data in images
- ✓ E.Clearing event logs
Why A: Installing a rootkit is a classic method for covering tracks because it operates at the kernel or user level to intercept system calls (e.g., NtQuerySystemInformation on Windows) and hide malicious files, processes, registry keys, and network connections from standard enumeration tools like Task Manager or netstat. This prevents the victim from detecting the compromise during routine monitoring.
Variation 2. Which TWO of the following are common techniques used to cover tracks after compromising a system? (Choose TWO.)
easy- A.Running a vulnerability scanner
- B.Enabling firewall rules
- ✓ C.Installing a rootkit
- D.Creating new user accounts
- ✓ E.Clearing event logs
Why C: Installing a rootkit (Option C) is a common technique used to cover tracks because rootkits are designed to hide the attacker's presence by subverting the operating system's normal behavior, such as hiding processes, files, and registry keys from system utilities. Clearing event logs (Option E) directly removes forensic evidence of the attacker's activities, such as login attempts, privilege escalations, or file access, making it harder for incident responders to reconstruct the attack timeline.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.