Detailed Explanations for Questions 151-180
Q151. In which phase within the ethical hacking framework do you alter or delete log information?
- A. Scanning and enumeration
- B. Gaining access
- C. Reconnaissance
- D. Covering tracks ✓
Why D is correct: Covering tracks is the final phase of the CEH hacking methodology, where attackers remove evidence of their presence and activities. This includes deleting or modifying system, event, application, and audit logs to prevent detection by security administrators and hinder forensic investigations.
Why others are incorrect:
- A: Scanning and enumeration involve discovering systems, open ports, services, and user accounts—not hiding activities
- B: Gaining access is about exploiting vulnerabilities to enter systems, not removing evidence
- C: Reconnaissance is the initial information-gathering phase conducted before any system access occurs
Q152. You are part of the help desk team. You receive a ticket from one of your users reporting that their computer is slowing down periodically. The user also states that from time to time, documents have either disappeared or have been moved from their original location to another. You remote desktop to the user’s computer and investigate. Where is the most likely place to see if any new processes have started?
- A. The Processes tab in Task Manager ✓
- B. C:\Temp
- C. The Logs tab in Task Manager
- D. C:\Windows\System32\User
Why A is correct: The Processes tab in Windows Task Manager displays all currently running processes, including their CPU/memory usage, process names, and PIDs. This is the primary location to identify suspicious or unauthorized processes that may indicate malware infection or unauthorized access.
Why others are incorrect:
- B: C:\Temp is a temporary file storage location, not a process monitoring tool
- C: Task Manager does not have a “Logs tab”; Windows Event Viewer handles system logs
- D: C:\Windows\System32\User is not a valid Windows directory path
Q153. You are an attacker who has successfully infiltrated your target’s web server. You performed a web defacement on the targeted organization’s website, and you were able to create your own credentials with administrative privileges. Before conducting data exfiltration, what is the next move?
- A. Log into the new user account that you created.
- B. Go back and delete or edit the logs. ✓
- C. Ensure that you log out of the session.
- D. Ensure that you migrate to a different session and log out.
Why B is correct: After gaining access and performing malicious activities, attackers typically cover their tracks by deleting or modifying logs before exfiltrating data. This prevents security teams from detecting the breach timeline, the attacker’s methods, and the compromised accounts used.
Why others are incorrect:
- A: Logging into the new account would generate additional log entries, increasing detection risk
- C: Simply logging out leaves all activity logs intact for forensic analysis
- D: Session migration doesn’t address the fundamental need to remove evidence of the attack
Q154. Where is the logfile that is associated with the activities of the last user who signed in within a Linux system?
- A. /var/log/user_log
- B. /var/log/messages
- C. /var/log/lastlog ✓
- D. /var/log/last_user
Why C is correct: The /var/log/lastlog file in Linux maintains a database recording the last login time for each user account. The lastlog command reads this file to display login history, making it valuable for both administrators monitoring access and attackers tracking user activity patterns.
Why others are incorrect:
- A:
/var/log/user_logis not a standard Linux log file - B:
/var/log/messagescontains general system messages and kernel logs, not specific last-login data - D:
/var/log/last_useris not a standard Linux log file
Q155. What file within the Linux OS contains administrative information about a user?
- A. /etc/shadow
- B. /etc/passwd ✓
- C. /home
- D. /home/profile
Why B is correct: The /etc/passwd The file contains user account information, including username, UID, GID, home directory, default shell, and the GECOS field (which can store full name, phone number, office location). This file is world-readable and provides administrative metadata about users.
Why others are incorrect:
- A:
/etc/shadowcontains password hashes and password policy information, not descriptive user data - C:
/homeis a directory containing user home directories, not a file with account information - D:
/home/profileis not a standard Linux file
Q156. What command in Windows allows you to bring up a list of startup items, including their locations in the Registry or the file system?
- A. Mslookup
- B. MSConfig ✓
- C. Regedit
- D. iexplorer.exe
Why B is correct: MSConfig (System Configuration utility) displays startup programs, services, and boot options. The Startup tab shows applications configured to run at boot, including their file paths and Registry locations, helping identify potentially malicious auto-start entries.
Why others are incorrect:
- A: Mslookup is a DNS query tool, not related to startup item management
- C: Regedit allows direct Registry editing, but doesn’t provide a consolidated startup items view
- D: iexplorer.exe launches Internet Explorer, not system configuration utilities
Q157. The SAM log file entry is located in what part of the Windows Registry system?
- A. HKEY_LOCAL_MACHINE\SAM ✓
- B. HKEY_LOCAL_SAM
- C. HKEY_LOCAL_MACHINE\WINDOWS
- D. HKEY_SYSTEM_MACHINE\SAME.L
Why A is correct: The Security Account Manager (SAM) database and its log file are stored under HKEY_LOCAL_MACHINE\SAM in the Windows Registry. This hive contains user account information, password hashes, and security policies for local accounts.
Why others are incorrect:
- B:
HKEY_LOCAL_SAMis not a valid Registry hive path - C:
HKEY_LOCAL_MACHINE\WINDOWSis not the correct location for SAM data - D:
HKEY_SYSTEM_MACHINEis not a valid Registry root key; the correct root isHKEY_LOCAL_MACHINE
Q158. What is the password file of a Windows system located in which of the following directories?
- A. C:\System32\Windows\config
- B. \etc\win\config
- C. C:\System\Windows\config
- D. C:\Windows\System32\config ✓
Why D is correct: The SAM (Security Account Manager) file containing password hashes is located at C:\Windows\System32\config\SAM. This file is locked by the operating system when Windows is running and requires special techniques (like offline access or volume shadow copy) to extract.
Why others are incorrect:
- A:
C:\System32\Windows\confighas incorrect path ordering (System32 is inside Windows, not outside) - B:
\etc\win\configmimics Linux directory structure and doesn’t exist in Windows - C:
C:\System\Windows\configis not a valid Windows directory structure
Q159. In Windows, what command can you use to hide a file?
- A. +h attrib <filename>
- B. h+ <filename>
- C. filename attrib+h
- D. attrib +h <filename> ✓
Why D is correct: The correct syntax for the attrib command to hide a file is attrib +h <filename>. The +h switch adds the Hidden attribute, making the file invisible in Windows Explorer unless “Show hidden files” is enabled.
Why others are incorrect:
- A:
+h attribhas the switch and command reversed; attrib must come first - B:
h+is not valid attrib syntax - C:
filename attrib+hhas incorrect command ordering; the command must precede the filename
Q160. What do NTFS alternate data streams provide?
- A. They can hide a file behind another file. ✓
- B. They prevent a file from being changed.
- C. They prevent a file from being moved.
- D. They prevent an unauthorized user from viewing the file.
Why A is correct: NTFS Alternate Data Streams (ADS) allow additional data to be attached to a file without changing its apparent size or content. Attackers use ADS to hide malicious code or data behind legitimate files, as standard file listings don’t show ADS content.
Why others are incorrect:
- B: ADS doesn’t provide file protection or change prevention
- C: ADS doesn’t prevent file movement; it’s a storage feature, not a security control
- D: ADS doesn’t provide access control; hidden data in ADS can still be accessed with the right tools
Q161. What is the issue when there is no boundary being checked or validated in programming?
- A. The program will assign its own values.
- B. The program does not validate if the input values can be stored without overwriting the next memory segment. ✓
- C. The program executes without checking what other programs are open.
- D. Memory allocation has already been reserved for a program.
Why B is correct: Without boundary checking, programs cannot verify that input data fits within allocated memory buffers. This allows attackers to write beyond buffer boundaries, overwriting adjacent memory including return addresses, function pointers, or other critical data—enabling arbitrary code execution.
Why others are incorrect:
- A: Programs don’t automatically assign values; the issue is unvalidated external input
- C: Boundary checking relates to memory management, not monitoring other running programs
- D: Memory reservation is separate from input validation; the vulnerability is in handling input that exceeds allocated space
Q162. When writing a program, what is one of the fundamental tasks that should be done when declaring a variable?
- A. Assign a random value to it.
- B. Do not assign a value because it can corrupt data.
- C. Initialize the variable. ✓
- D. A variable does not need to be initialized.
Why C is correct: Initializing variables ensures they contain known, predictable values rather than residual data from previous memory usage. Uninitialized variables may contain sensitive data residue or unpredictable values that can cause security vulnerabilities or program instability.
Why others are incorrect:
- A: Assigning random values doesn’t solve the security issue; initialization with appropriate default values is needed
- B: Not assigning values leaves variables with unpredictable memory residue, creating security risks
- D: Variables should always be initialized; relying on default values is poor programming practice
Q163. What is a heap?
- A. A static allocation of memory
- B. A memory segment located within the CPU
- C. Memory that is swapped to the hard drive
- D. Memory allocation of a size and location that is assigned dynamically ✓
Why D is correct: The heap is a region of memory used for dynamic memory allocation during program execution. Unlike the stack (which has fixed allocation at compile time), heap memory can be allocated and freed at runtime using functions like malloc() and free().
Why others are incorrect:
- A: Static allocation occurs on the stack or in global data segments, not the heap
- B: CPU registers are separate from heap memory; the heap resides in RAM
- C: Swapped memory refers to virtual memory paging to disk, not the heap specifically
Q164. What is the region in memory that is assigned to a process or a program when it is initiated?
- A. Cluster
- B. Stack ✓
- C. Heap
- D. Pointer
Why B is correct: When a program starts, the stack is allocated to manage function calls, local variables, and return addresses. The stack operates on a Last-In-First-Out (LIFO) principle and has a fixed size allocated at program initialization.
Why others are incorrect:
- A: “Cluster” isn’t a standard memory region term in this context
- C: The heap is allocated for dynamic memory, but isn’t the primary region assigned at program initiation
- D: A pointer is a variable type that stores memory addresses, not a memory region
Q165. What is a buffer used for?
- A. Dynamic data storage
- B. Static data storage ✓
- C. Data in transit
- D. Processing power
Why B is correct: A buffer is a fixed-size block of memory allocated for temporary data storage. Buffers have predetermined sizes, and writing beyond these boundaries causes buffer overflow vulnerabilities.
Why others are incorrect:
- A: Dynamic data storage occurs on the heap, not in fixed-size buffers
- C: Data in transit refers to network communication, not memory buffer usage
- D: Processing power relates to CPU capabilities, not memory storage
Q166. What type of attack would the following code be vulnerable to? char[5] attacker; strcpy(attacker,”cat/etc/passwd”); scanf(&attacker);
- A. Buffer overflow ✓
- B. SQL injection
- C. Command injection
- D. Heap spraying
Why A is correct: The code declares a 5-character buffer but attempts to copy a much longer string (“cat/etc/passwd” is 14+ characters) using strcpy(), which doesn’t check boundaries. The subsequent scanf() call could allow user input to overwrite memory beyond the buffer, enabling arbitrary code execution.
Why others are incorrect:
- B: SQL injection targets database queries, not C string operations
- C: Command injection involves executing OS commands through application input, not memory corruption
- D: Heap spraying targets dynamically allocated heap memory, not stack-based buffers
Q167. What application exploit type works against dynamic memory allocations?
- A. Return to libc
- B. Heap spraying ✓
- C. Buffer overflow
- D. Stack smashing
Why B is correct: Heap spraying fills the heap with malicious code or NOP sleds to increase the probability that a memory corruption vulnerability will redirect execution to attacker-controlled code. It specifically targets dynamically allocated heap memory.
Why others are incorrect:
- A: Return to libc attacks target the stack by redirecting execution to known library functions
- C: Buffer overflow typically targets stack-based buffers, though heap overflows exist
- D: Stack smashing specifically targets stack memory, not heap allocations
Q168. Why is address space layout randomization successful against buffer overflow attacks?
- A. Return address keeps changing ✓
- B. Stack no longer exists
- C. Return address is wrapped
- D. Stack pointer moves
Why A is correct: Address Space Layout Randomization (ASLR) randomizes memory addresses for the stack, heap, libraries, and executable code each time a program runs. This means the return address an attacker tries to overwrite points to a different location each execution, making reliable exploitation much harder.
Why others are incorrect:
- B: The stack still exists with ASLR; only its memory location is randomized
- C: Return addresses aren’t “wrapped”; they’re randomized to unpredictable locations
- D: While the stack pointer does move during execution, this isn’t why ASLR prevents exploitation
Q169. What type of application has impacted Ring 0?
- A. Root access
- B. Malware
- C. Rootkit ✓
- D. Trojan virus
Why C is correct: Ring 0 is the kernel mode with the highest privileges in the x86 architecture. Rootkits are specifically designed to operate at the kernel level (Ring 0), allowing them to hide processes, files, and network connections from user-mode security tools.
Why others are incorrect:
- A: “Root access” is a privilege level, not a type of application
- B: While rootkits are malware, not all malware operates at Ring 0
- D: Trojans typically operate at the user level (Ring 3), not the kernel level
Q170. Malware installed at the kernel is very difficult to detect with products such as antivirus and anti-malware programs. What is this type of malware called?
- A. Ransomware
- B. Rootkit ✓
- C. Vampire tap
- D. Worm
Why B is correct: Rootkits operate at the kernel level (Ring 0), giving them the ability to intercept and modify operating system calls. This allows them to hide their presence from user-mode security software, making detection extremely difficult without specialized kernel-level tools.
Why others are incorrect:
- A: Ransomware encrypts files for extortion but doesn’t necessarily operate at the kernel level
- C: Vampire taps are physical network tapping devices, not malware
- D: Worms self-replicate across networks but typically operate at the user level
Q171. What type of malware can be used to provide backdoor access to a system?
- A. Trojan
- B. Rootkit ✓
- C. Root virus
- D. Spyware
Why B is correct: Rootkits often include backdoor functionality that provides persistent, hidden remote access to compromised systems. Operating at the kernel level, they can bypass security controls and remain undetected while allowing an attacker access.
Why others are incorrect:
- A: Trojans disguise themselves as legitimate software but don’t necessarily provide kernel-level backdoors
- C: “Root virus” isn’t a standard malware classification
- D: Spyware monitors user activity but isn’t primarily designed for backdoor access
Q172. Which of the following tools allows you to capture passwords from the system Registry as well as from the memory of a compromised system?
- A. Nmap
- B. LSASS
- C. CryptCat
- D. Mimikatz ✓
Why D is correct: Mimikatz is a post-exploitation tool that extracts plaintext passwords, hashes, PINs, and Kerberos tickets from Windows memory (LSASS process) and the Registry. It’s widely used by both attackers and penetration testers for credential harvesting.
Why others are incorrect:
- A: Nmap is a port scanner, not a credential extraction tool
- B: LSASS (Local Security Authority Subsystem Service) is the Windows process that stores credentials, not a tool to extract them
- C: CryptCat is an encrypted version of Netcat for network connections, not credential extraction
Q173. You’ve just compromised a system using Metasploit. What module would you now load to collect passwords from memory?
- A. dumphash
- B. autoroute
- C. mimikatz ✓
- D. siddump
Why C is correct: Within Metasploit’s Meterpreter session, the mimikatz module (or load kiwi in newer versions) provides the same credential extraction capabilities as the standalone Mimikatz tool, allowing password and hash extraction from compromised Windows systems.
Why others are incorrect:
- A:
hashdump(not dumphash) dumps password hashes from the SAM database, not memory - B:
autorouteenables network pivoting through the compromised host, not credential extraction - D:
siddumpis not a valid Metasploit module
Q174. What operating-system-agnostic feature of Metasploit would you use to perform tasks on a compromised system, including getting keystrokes?
- A. Meterpreter ✓
- B. Metainterpreter
- C. Spelunker
- D. Mimikatz
Why A is correct: Meterpreter is Metasploit’s advanced, in-memory payload that provides a comprehensive post-exploitation framework. It’s OS-agnostic, runs entirely in memory (avoiding disk writes), and includes modules for keylogging, screen capture, file manipulation, and more.
Why others are incorrect:
- B: “Metainterpreter” is not a real Metasploit component
- C: “Spelunker” is not a Metasploit feature
- D: Mimikatz is Windows-specific for credential extraction, not a general post-exploitation framework
Q175. If you’ve compromised a system that has multiple network interfaces, what technique could you use to gain access to the other networks using the compromised system?
- A. Kerberoasting
- B. Trampolining
- C. Privilege escalation
- D. Pivoting ✓
Why D is correct: Pivoting uses a compromised system as a relay or proxy to access other networks that aren’t directly reachable from the attacker’s position. This technique allows lateral movement through network segments using the compromised host’s network interfaces.
Why others are incorrect:
- A: Kerberoasting extracts service account credentials from Kerberos, not network access
- B: “Trampolining” isn’t a standard penetration testing term
- C: Privilege escalation gains higher permissions on the same system, not access to other networks
Q176. What is it called when you use a victim system as a router to get to other networks behind the compromised system?
- A. Piggybacking
- B. Social engineering
- C. Pivoting ✓
- D. Auto-networking
Why C is correct: Pivoting specifically refers to using a compromised system to route traffic to otherwise inaccessible network segments. This technique is essential for penetrating segmented networks and reaching high-value targets behind multiple security layers.
Why others are incorrect:
- A: Piggybacking is a physical social engineering attack where an unauthorized person follows an authorized person into a secure area
- B: Social engineering manipulates people, not network routing
- D: “Auto-networking” isn’t a recognized penetration testing technique
Q177. A new user in a company is given a minimal set of privileges. As they are promoted and move to different positions, they continue to gain more privileges. What is this called?
- A. Privilege creep ✓
- B. Position creep
- C. Access creep
- D. Privilege escalation
Why A is correct: Privilege creep occurs when users accumulate access rights from previous roles without having old permissions revoked. This violates the principle of least privilege and increases security risk by granting unnecessary access.
Why others are incorrect:
- B: “Position creep” isn’t a standard security term
- C: “Access creep” isn’t the recognized term for this phenomenon
- D: Privilege escalation is an attack technique where an attacker gains higher permissions, not an administrative oversight
Q178. Which of the following is part of the overall portion of the SID?
- A. UID
- B. RID ✓
- C. USD
- D. L5R
Why B is correct: A Windows Security Identifier (SID) consists of a domain identifier plus a Relative Identifier (RID). The RID uniquely identifies a user, group, or computer within a domain (e.g., RID 500 for Administrator, 501 for Guest).
Why others are incorrect:
- A: UID (User ID) is a Unix/Linux concept, not part of Windows SIDs
- C: “USD” isn’t a component of Windows security identifiers
- D: “L5R” isn’t a recognized security identifier component
Q179. The guest account under a Windows system has the RID of what?
- A. Not a RID, but a SID of 502
- B. RID 501 ✓
- C. RID 1001
- D. RID 1000
Why B is correct: The built-in Guest account in Windows has the well-known Relative Identifier (RID) of 501. This value is consistent across all Windows installations and cannot be changed, making it a reliable indicator for security assessments.
Why others are incorrect:
- A: The Guest account does have a RID (501), not just a SID
- C: RID 1001 is typically assigned to the first user-created account, not built-in accounts
- D: RID 1000 is typically the first user-created account in newer Windows versions
Q180. What is the initial value of the SID that is used to annotate an administrator’s account?
- A. 500 ✓
- B. 100
- C. 5000
- D. 1
Why A is correct: The built-in Administrator account in Windows has the well-known Relative Identifier (RID) of 500. This value is hardcoded and consistent across all Windows installations, making it a key target for attackers and an important indicator for security monitoring.
Why others are incorrect:
- B: 100 isn’t a well-known RID for built-in Windows accounts
- C: 5000 isn’t a standard RID for built-in accounts
- D: 1 isn’t used as a RID for built-in Windows accounts; RIDs start at 500 for built-in accounts
Key Takeaways for Module 6: System Hacking
- Covering Tracks: Always the final phase; it involves log manipulation, file deletion, and evidence removal to avoid detection.
- Windows System Files: Know critical locations: SAM at
C:\Windows\System32\config, Registry hives underHKEY_LOCAL_MACHINE. - Linux System Files:
/etc/passwdfor user info,/etc/shadowfor password hashes,/var/log/lastlogfor login history. - Memory Management: Understand stack (static, LIFO) vs. heap (dynamic allocation) and how buffer overflows exploit boundary checking failures.
- Rootkits: Kernel-level malware that’s extremely difficult to detect; operates at Ring 0 with the highest privileges.
- Credential Tools: Mimikatz extracts credentials from memory/Registry; integrated into Metasploit’s Meterpreter.
- Pivoting: Using compromised systems to access other network segments; essential for penetrating segmented environments.
- Windows SIDs/RIDs: Administrator=500, Guest=501; these well-known values help identify account types during enumeration.
- Privilege Creep: Administrative oversight where users accumulate unnecessary permissions; violates the least privilege principle.
- NTFS ADS: Alternate Data Streams can hide malicious content behind legitimate files; requires specialized tools to detect.
