CEH Enumeration and System Hacking Practice Question

Correct answer & explanation

NTFS Alternate Data Streams (option C) are a Windows file-system feature that lets extra data be attached to an existing file without changing its visible size or content, so an attacker can hide payloads or exfiltrated data behind a legitimate-looking file. Steganography (option E) conceals data inside other files such as images, audio, or video, making the hidden content difficult to detect without specialized analysis. Rootkits (option A) are used to hide the presence of malware, processes, or files by subverting the OS, but they are not themselves a file-hiding method in the same direct sense as ADS or steganography. Token impersonation (option B) is a privilege-escalation and lateral-movement technique that steals another user's access token, not a file-hiding method. Log manipulation (option D) is an anti-forensic technique for altering or deleting audit records, not for concealing files on disk.