Ethical Hacking System Hacking 2

Question 1

What is the primary function of a software keylogger in system hacking?

Accepted Answer

Recording all keystrokes entered on a compromised system to capture sensitive data

Answer

Encrypting keystrokes to prevent interception by other attackers

Answer

Monitoring network traffic for credentials transmitted in plaintext

Answer

Scanning the local system for stored password files

Question 2

Which Windows subsystem service stores user credentials in memory to support single sign-on and is a primary target for credential dumping tools like Mimikatz?

Accepted Answer

LSASS (Local Security Authority Subsystem Service)

Answer

Windows Defender Credential Guard

Answer

Task Scheduler Service

Answer

Windows Management Instrumentation (WMI)

Question 3

What is lateral movement in the context of post-exploitation system hacking?

Accepted Answer

Using compromised credentials or exploits to spread access to other systems within the same network

Answer

Escalating privileges on the initially compromised system to administrator level

Answer

Exfiltrating collected data from the target environment to an external server

Answer

Establishing persistence mechanisms on the initially compromised system

Question 4

Which technique involves loading a malicious DLL into the address space of a legitimate running process to execute attacker-controlled code?

Accepted Answer

DLL Injection

Answer

SQL Injection

Answer

Process Hollowing

Answer

Heap Spraying

Question 5

What is the primary purpose of establishing a backdoor on a compromised system?

Accepted Answer

To maintain persistent remote access even after system reboots or credential changes

Answer

To immediately exfiltrate all sensitive data before detection occurs

Answer

To encrypt the victim's files and demand ransom for decryption

Answer

To perform man-in-the-middle attacks on network communications

Question 6

Which privilege escalation technique exploits weak file permissions on service executable files to run malicious code with elevated privileges?

Accepted Answer

Service binary hijacking (binary path replacement)

Answer

Kernel exploitation via unpatched CVE

Answer

Token impersonation via Meterpreter

Answer

UAC bypass using registry manipulation

Question 7

Why do attackers typically clear Windows event logs after a successful compromise?

Accepted Answer

To destroy forensic evidence of their activities and impede incident response

Answer

To free up disk space needed for storing exfiltrated data

Answer

To prevent Windows from generating new alerts about system activity

Answer

To disable Windows Defender real-time protection and alerting