312-50V11 · Question #1019
Which among the following is the best example of the hacking concept called "clearing tracks"?
The correct answer is D. During a cyberattack, a hacker corrupts the event logs on all machines. Clearing tracks is the hacking phase focused on erasing evidence of an intrusion to avoid detection and forensic analysis. Corrupting event logs directly removes audit trail records that investigators rely on.
Question
Which among the following is the best example of the hacking concept called "clearing tracks"?
Options
- AAfter a system is breached, a hacker creates a backdoor to allow re-entry into a system.
- BDuring a cyberattack, a hacker injects a rootkit into a server.
- CAn attacker gains access to a server through an exploitable vulnerability.
- DDuring a cyberattack, a hacker corrupts the event logs on all machines.
How the community answered
(61 responses)- A3% (2)
- B2% (1)
- C8% (5)
- D87% (53)
Why each option
Clearing tracks is the hacking phase focused on erasing evidence of an intrusion to avoid detection and forensic analysis. Corrupting event logs directly removes audit trail records that investigators rely on.
Creating a backdoor is the 'maintaining access' phase of hacking, which ensures persistent re-entry, not the removal of evidence.
Injecting a rootkit is a technique associated with privilege escalation and maintaining stealthy persistence, not specifically with erasing forensic evidence.
Gaining access through an exploitable vulnerability represents the 'gaining access' or exploitation phase, which precedes clearing tracks.
Corrupting or deleting event logs is a textbook example of clearing tracks because event logs are the primary forensic artifact used to detect and reconstruct an intrusion. By corrupting logs on all machines, the attacker eliminates timestamped records of their actions, making detection and incident response significantly harder. This maps directly to the 'Indicator Removal' technique in the post-exploitation phase of the hacking lifecycle.
Concept tested: Clearing tracks via event log manipulation
Source: https://attack.mitre.org/techniques/T1070/
Topics
Community Discussion
No community discussion yet for this question.