CEH Enumeration and System Hacking Practice Question
Which TWO of the following are common techniques used to cover tracks after compromising a system? (Choose TWO.)
⚠ Common exam trap
In the CEH exam, candidates often mistakenly select creating new user accounts (Option D) as a track-covering technique when it is actually a persistence method that leaves obvious traces. Covering tracks focuses on hiding evidence of the attack, such as clearing logs or using rootkits to conceal malicious activity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Installing a rootkit
Installing a rootkit (Option C) is a common technique used to cover tracks because rootkits are designed to hide the attacker's presence by subverting the operating system's normal behavior, such as hiding processes, files, and registry keys from system utilities. Clearing event logs (Option E) directly removes forensic evidence of the attacker's activities, such as login attempts, privilege escalations, or file access, making it harder for incident responders to reconstruct the attack timeline.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Running a vulnerability scanner
Why it's wrong here
Running a vulnerability scanner is an active reconnaissance technique used to identify weaknesses in a target system before or during an attack, not after to cover tracks. This process generates significant network traffic, system logs, and potentially triggers intrusion detection systems, making the attacker's presence highly visible and easily detectable. Far from concealing activity, it actively broadcasts an attacker's probing actions, directly contradicting the goal of stealth.
- ✗
Enabling firewall rules
Why it's wrong here
Enabling firewall rules is generally counterproductive for an attacker attempting to maintain access or cover their presence on a compromised system. Attackers typically aim to weaken or disable firewalls to facilitate command-and-control communication, data exfiltration, or lateral movement. Actively enabling new rules could inadvertently block their established backdoors or communication channels, and any modification to firewall configurations leaves clear, auditable evidence that security teams can easily discover during an investigation.
- ✓
Installing a rootkit
Why this is correct
Installing a rootkit is a highly effective technique for covering an attacker's tracks by providing stealthy, persistent access. Rootkits are designed to modify the operating system's core functions, either at the kernel or userland level, to conceal files, processes, network connections, and other malicious artifacts from legitimate system utilities and security software. This sophisticated level of hiding allows an attacker to maintain a covert presence, making detection extremely challenging for administrators and forensic analysts.
- ✗
Creating new user accounts
Why it's wrong here
Creating new user accounts, while a common method for establishing persistence on a compromised system, is not a technique for covering tracks; rather, it generates significant forensic evidence. Every new user account creation, especially one with elevated privileges, is meticulously logged by the operating system (e.g., Windows Security Event ID 4720). These distinct log entries provide clear indicators of compromise that are easily discoverable during a security audit or incident response investigation, directly undermining the objective of stealth.
- ✓
Clearing event logs
Why this is correct
Clearing event logs is a fundamental and direct method used by attackers to cover their tracks and remove evidence of their activities on a compromised system. Attackers frequently delete or tamper with system, security, and application logs to erase records of their login attempts, command executions, file accesses, and other malicious actions. This critical step aims to hinder forensic investigations, prevent detection by security monitoring systems, and obscure the timeline of the attack, making it much harder for defenders to understand the scope of the breach.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.