Ethical Hacking System Hacking 2 — Questions and Answers
Question 1: What is the primary function of a software keylogger in system hacking?
- Encrypting keystrokes to prevent interception by other attackers
- Recording all keystrokes entered on a compromised system to capture sensitive data (Correct answer)
- Monitoring network traffic for credentials transmitted in plaintext
- Scanning the local system for stored password files
Correct answer: Recording all keystrokes entered on a compromised system to capture sensitive data
Keyloggers capture and record every keystroke on a system, allowing attackers to steal passwords, credit card numbers, messages, and other sensitive input.
Question 2: Which Windows subsystem service stores user credentials in memory to support single sign-on and is a primary target for credential dumping tools like Mimikatz?
- Windows Defender Credential Guard
- LSASS (Local Security Authority Subsystem Service) (Correct answer)
- Task Scheduler Service
- Windows Management Instrumentation (WMI)
Correct answer: LSASS (Local Security Authority Subsystem Service)
LSASS stores credentials in memory to facilitate Windows authentication; Mimikatz and similar tools target this process to extract plaintext passwords and hashes.
Question 3: What is lateral movement in the context of post-exploitation system hacking?
- Escalating privileges on the initially compromised system to administrator level
- Using compromised credentials or exploits to spread access to other systems within the same network (Correct answer)
- Exfiltrating collected data from the target environment to an external server
- Establishing persistence mechanisms on the initially compromised system
Correct answer: Using compromised credentials or exploits to spread access to other systems within the same network
Lateral movement involves leveraging compromised credentials, pass-the-hash, or exploits to extend access from one machine to other systems within the target network.
Question 4: Which technique involves loading a malicious DLL into the address space of a legitimate running process to execute attacker-controlled code?
- SQL Injection
- Process Hollowing
- DLL Injection (Correct answer)
- Heap Spraying
Correct answer: DLL Injection
DLL injection loads a malicious dynamic-link library into the memory space of a legitimate process, executing attacker code under the cover of a trusted application.
Question 5: What is the primary purpose of establishing a backdoor on a compromised system?
- To immediately exfiltrate all sensitive data before detection occurs
- To maintain persistent remote access even after system reboots or credential changes (Correct answer)
- To encrypt the victim's files and demand ransom for decryption
- To perform man-in-the-middle attacks on network communications
Correct answer: To maintain persistent remote access even after system reboots or credential changes
Backdoors provide persistent, covert remote access to a compromised system even if the initial vulnerability is patched or user passwords are changed.
Question 6: Which privilege escalation technique exploits weak file permissions on service executable files to run malicious code with elevated privileges?
- Kernel exploitation via unpatched CVE
- Service binary hijacking (binary path replacement) (Correct answer)
- Token impersonation via Meterpreter
- UAC bypass using registry manipulation
Correct answer: Service binary hijacking (binary path replacement)
Service binary hijacking replaces or modifies a service executable due to misconfigured weak permissions, causing the service to execute the attacker's code with SYSTEM or admin privileges.
Question 7: Why do attackers typically clear Windows event logs after a successful compromise?
- To free up disk space needed for storing exfiltrated data
- To destroy forensic evidence of their activities and impede incident response (Correct answer)
- To prevent Windows from generating new alerts about system activity
- To disable Windows Defender real-time protection and alerting
Correct answer: To destroy forensic evidence of their activities and impede incident response
Clearing event logs is an anti-forensics technique that destroys evidence of attacker actions, making incident investigation and attribution significantly more difficult.
Ethical Hacking System Hacking 2
What is the primary function of a software keylogger in system hacking?