nerdexam
EC-Council

312-50V11 · Question #1019

Which among the following is the best example of the hacking concept called "clearing tracks"?

The correct answer is D. During a cyberattack, a hacker corrupts the event logs on all machines. Clearing tracks is the hacking phase focused on erasing evidence of an intrusion to avoid detection and forensic analysis. Corrupting event logs directly removes audit trail records that investigators rely on.

System Hacking

Question

Which among the following is the best example of the hacking concept called "clearing tracks"?

Options

  • AAfter a system is breached, a hacker creates a backdoor to allow re-entry into a system.
  • BDuring a cyberattack, a hacker injects a rootkit into a server.
  • CAn attacker gains access to a server through an exploitable vulnerability.
  • DDuring a cyberattack, a hacker corrupts the event logs on all machines.

How the community answered

(61 responses)
  • A
    3% (2)
  • B
    2% (1)
  • C
    8% (5)
  • D
    87% (53)

Why each option

Clearing tracks is the hacking phase focused on erasing evidence of an intrusion to avoid detection and forensic analysis. Corrupting event logs directly removes audit trail records that investigators rely on.

AAfter a system is breached, a hacker creates a backdoor to allow re-entry into a system.

Creating a backdoor is the 'maintaining access' phase of hacking, which ensures persistent re-entry, not the removal of evidence.

BDuring a cyberattack, a hacker injects a rootkit into a server.

Injecting a rootkit is a technique associated with privilege escalation and maintaining stealthy persistence, not specifically with erasing forensic evidence.

CAn attacker gains access to a server through an exploitable vulnerability.

Gaining access through an exploitable vulnerability represents the 'gaining access' or exploitation phase, which precedes clearing tracks.

DDuring a cyberattack, a hacker corrupts the event logs on all machines.Correct

Corrupting or deleting event logs is a textbook example of clearing tracks because event logs are the primary forensic artifact used to detect and reconstruct an intrusion. By corrupting logs on all machines, the attacker eliminates timestamped records of their actions, making detection and incident response significantly harder. This maps directly to the 'Indicator Removal' technique in the post-exploitation phase of the hacking lifecycle.

Concept tested: Clearing tracks via event log manipulation

Source: https://attack.mitre.org/techniques/T1070/

Topics

#clearing tracks#event log tampering#log corruption#post-exploitation

Community Discussion

No community discussion yet for this question.

Full 312-50V11 Practice