Certified Ethical Hacker System Hacking and Malware 4

Question 1

An attacker wants to maintain persistent access to a compromised Windows host across reboots. Which location is commonly abused for autostart persistence?

Accepted Answer

The Run registry key

Answer

The HKLM/HKCU Run registry keys execute programs automatically at startup, enabling persistence.

Question 2

Which attack precomputes hashes for many possible passwords to speed up cracking but is defeated by salting?

Accepted Answer

Rainbow table attack

Answer

Rainbow tables use precomputed hash chains, which salting defeats by making each hash unique.

Question 3

A keylogger implemented as a small hardware device inserted between the keyboard and the computer is which type?

Accepted Answer

Hardware keylogger

Answer

A physical device placed inline with the keyboard cable is a hardware keylogger.

Question 4

Which technique uses legitimate system tools already present on a host (like PowerShell or WMI) to avoid dropping detectable malware files?

Accepted Answer

Living off the land (LOLBins)

Answer

Living-off-the-land attacks abuse built-in trusted binaries to operate without dropping new files.

Question 5

During post-exploitation, an attacker dumps credentials from the LSASS process memory on Windows. Which tool is most associated with this?

Accepted Answer

Mimikatz

Answer

Mimikatz extracts credentials, hashes, and tickets from LSASS memory.

Certified Ethical Hacker Practice Test

Certified Ethical Hacker Practice Test

Certified Ethical Hacker System Hacking and Malware 4