Common Covering Tracks Techniques
Which TWO of the following are common techniques for covering tracks after compromising a system? (Select 2)
Quick Answer
The answer is using steganography to hide exfiltrated data in image files, paired with log manipulation. These two are common covering tracks techniques because after compromising a system, an attacker must erase forensic evidence of their activity while also concealing stolen data in plain sight. Log manipulation involves clearing, altering, or disabling audit logs to hide the intrusion trail, whereas steganography embeds exfiltrated data within innocuous files like images or audio, making it undetectable during routine network monitoring. On the Certified Ethical Hacker CEH exam, this topic tests your understanding of the post-exploitation phase, where covering tracks is the final step to avoid detection. A common trap is confusing simple file deletion with manipulation—deletion is obvious and often triggers alerts, while subtle log editing or steganography is stealthier. Remember the mnemonic “Hide and Clean”: steganography hides the payload, while log cleaning hides the path.
⚠ Common exam trap
EC-CEH often tests the distinction between post-exploitation cover-up actions (log manipulation, steganography) and pre-emptive or defensive measures (password changes, honeypots), so candidates mistakenly select options that sound security-related but are not attacker cover-up techniques.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Manipulating event logs to remove evidence of intrusion
Manipulating event logs (e.g., clearing, modifying, or deleting entries in Windows Event Log or syslog) is a standard post-exploitation step to remove traces of unauthorized access, such as failed login attempts or privilege escalation events. Attackers often use tools like `wevtutil` or `clearlogs` to erase evidence, making forensic reconstruction difficult.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increasing the frequency of password changes
Why it's wrong here
Password changes do not cover tracks of prior compromise.
- ✗
Enabling verbose logging for future attacks
Why it's wrong here
Verbose logging would increase evidence, not cover tracks.
- ✓
Manipulating event logs to remove evidence of intrusion
Why this is correct
Attackers often clear or modify logs to hide their activities.
- ✓
Using steganography to hide exfiltrated data in image files
Why this is correct
Steganography hides data, making it less detectable during exfiltration.
- ✗
Setting up a honeypot to distract defenders
Why it's wrong here
Honeypots are defensive, not a cover-tracks technique.
Go deeper
Related to this question
Learn chapter
System Hacking
Key term
Privilege escalation
Privilege escalation is when a user or attacker gains more access or control over a system than they are supposed to have.
Key term
Covering Tracks
Covering tracks is the process attackers use to hide their activity and remove evidence of a security breach after gaining unauthorized access to a system.
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are common techniques used to cover tracks after compromising a system? (Choose TWO.)
easy- A.Running a vulnerability scanner
- B.Enabling firewall rules
- ✓ C.Installing a rootkit
- D.Creating new user accounts
- ✓ E.Clearing event logs
Why C: Installing a rootkit (Option C) is a common technique used to cover tracks because rootkits are designed to hide the attacker's presence by subverting the operating system's normal behavior, such as hiding processes, files, and registry keys from system utilities. Clearing event logs (Option E) directly removes forensic evidence of the attacker's activities, such as login attempts, privilege escalations, or file access, making it harder for incident responders to reconstruct the attack timeline.
Variation 2. Which THREE of the following are methods for covering tracks after compromising a system? (Select 3)
hard- ✓ A.Installing a rootkit to hide files and processes
- B.Escalating privileges to SYSTEM
- C.Disabling antivirus software
- ✓ D.Using steganography to hide stolen data in images
- ✓ E.Clearing event logs
Why A: Installing a rootkit is a classic method for covering tracks because it operates at the kernel or user level to intercept system calls (e.g., NtQuerySystemInformation on Windows) and hide malicious files, processes, registry keys, and network connections from standard enumeration tools like Task Manager or netstat. This prevents the victim from detecting the compromise during routine monitoring.
Variation 3. Which THREE of the following are valid techniques for covering tracks after compromising a system? (Select 3 correct answers)
hard- ✓ A.Clearing event logs using wevtutil
- B.Exploiting SUID binaries to gain root
- ✓ C.Installing a rootkit to hide malicious processes
- ✓ D.Using timestomp to modify file timestamps
- E.Disabling Windows Defender via Group Policy
Why A: A is correct because wevtutil is a Windows command-line utility used to manage event logs. After compromising a system, an attacker can use 'wevtutil cl' followed by a log name (e.g., 'wevtutil cl System') to clear specific event logs, thereby erasing evidence of their activities. This is a direct and common technique for covering tracks by removing forensic artifacts.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.