Certified Ethical Hacker System Hacking and Malware 4

Question 1

An attacker wants to maintain persistent access to a compromised Windows host across reboots. Which location is commonly abused for autostart persistence?

Accepted Answer

The Run registry key

Answer

The HOSTS file

Answer

The ARP cache

Answer

The swap partition

Question 2

Which attack precomputes hashes for many possible passwords to speed up cracking but is defeated by salting?

Accepted Answer

Rainbow table attack

Answer

Phishing attack

Answer

Replay attack

Answer

Side-channel attack

Question 3

A keylogger implemented as a small hardware device inserted between the keyboard and the computer is which type?

Accepted Answer

Hardware keylogger

Answer

Software keylogger

Answer

Kernel keylogger

Answer

API-hooking keylogger

Question 4

Which technique uses legitimate system tools already present on a host (like PowerShell or WMI) to avoid dropping detectable malware files?

Accepted Answer

Living off the land (LOLBins)

Answer

Drive-by download

Answer

Watering hole

Answer

Typosquatting

Question 5

During post-exploitation, an attacker dumps credentials from the LSASS process memory on Windows. Which tool is most associated with this?

Accepted Answer

Mimikatz

Answer

Burp Suite

Answer

sqlmap

Answer

Aircrack-ng

Question 6

Which malware analysis approach examines a binary's strings, imports, and disassembly WITHOUT executing it?

Accepted Answer

Static analysis

Answer

Dynamic analysis

Answer

Fuzzing

Answer

Sandboxing

Question 7

An attacker escalates from a standard user to SYSTEM by exploiting a service running as SYSTEM with a writable executable path. This is an example of what?

Accepted Answer

Vertical privilege escalation

Answer

Horizontal privilege escalation

Answer

Lateral movement

Answer

Credential stuffing