PenTest+ Covering Tracks and Cleanup Quiz

1. Which Windows file contains application execution history that should be cleared?

Prefetch files

Boot.ini

System.ini

Config.sys

2. Which lateral movement technique uses Kerberos tickets for authentication without passwords?

Pass-the-ticket

Pass-the-hash

Golden ticket

Silver ticket

3. What is the primary function of clearing Windows MFT (Master File Table) records during cleanup?

Remove evidence of deleted files

Improve disk performance

Repair corrupted sectors

Increase storage capacity

4. In macOS post-exploitation, which file stores command history that must be sanitized?

.zsh_history

.bash_profile

.profile

.login

5. Which lateral movement technique exploits the Windows NTLM authentication protocol?

Pass-the-ticket

Pass-the-hash

Pass-the-cookie

Pass-the-token

6. What is the primary risk of leaving persistence mechanisms during engagement cleanup?

Unauthorized re-entry after engagement ends

Loss of administrative privileges

System performance degradation

Network connectivity issues

7. Which log file in Linux typically records sudo command usage and should be cleared?

/var/log/auth.log

/var/log/kernel.log

/var/log/syslog

/var/log/apache2/access.log

8. In lateral movement, what is 'token impersonation'?

Using another user's access token to execute commands

Creating fake security tokens

Stealing API authentication keys

Modifying network authentication protocols

9. Which command removes temporary files in Windows that may contain forensic evidence?

Cipher /w

Defrag c:

Chkdsk /f

Sfc /scannow

10. What is the purpose of disabling or manipulating Windows Firewall logs during engagement cleanup?

Improve system performance

Remove evidence of unauthorized connections

Increase network bandwidth

Update security policies

11. Which tool is commonly used to clear Windows Event Logs during post-exploitation?

Wevtutil

Netstat

Ipconfig

Tasklist

12. In post-exploitation, what does 'persistence' refer to?

Maintaining access after initial compromise

Clearing log files regularly

Escalating to administrative privileges

Exfiltrating sensitive data

13. What is the primary advantage of using legitimate tools (living off the land) for lateral movement?

They are faster than custom tools

They bypass antivirus detection more easily

They require no special permissions

They leave no network traces

14. Which Windows service enables remote code execution for lateral movement?

RDP (Remote Desktop Protocol)

SSH (Secure Shell)

SNMP (Simple Network Management)

DHCP (Dynamic Host Configuration)

15. What is 'pass-the-hash' primarily used for in lateral movement?

Authenticating without plaintext passwords

Encrypting network traffic

Modifying firewall rules

Escalating privileges immediately

16. Which lateral movement technique uses legitimate system credentials to access other systems?

Pass-the-hash

Credential stuffing

Valid account compromise

Brute force attack

17. What does the 'last' command in Linux reveal that should be sanitized?

Running processes

User login history

Installed packages

Active network connections

18. In Windows, which registry hive contains user activity and recent file access?

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

HKEY_USERS

19. Which file stores command history in Linux that should be cleared during cleanup?

.bash_history

.bash_profile

.bashrc

.bash_logout

20. What is the primary purpose of clearing bash history in Linux post-exploitation?

Increase system performance

Remove evidence of executed commands

Update the system kernel

Reset user permissions

PenTest+ Covering Tracks and Engagement Cleanup Quiz

1. Which Windows file contains application execution history that should be cleared?

2.

What first name or nickname would you like us to use?

2. Which lateral movement technique uses Kerberos tickets for authentication without passwords?

3. What is the primary function of clearing Windows MFT (Master File Table) records during cleanup?

4. In macOS post-exploitation, which file stores command history that must be sanitized?

5. Which lateral movement technique exploits the Windows NTLM authentication protocol?

6. What is the primary risk of leaving persistence mechanisms during engagement cleanup?

7. Which log file in Linux typically records sudo command usage and should be cleared?

8. In lateral movement, what is 'token impersonation'?

9. Which command removes temporary files in Windows that may contain forensic evidence?

10. What is the purpose of disabling or manipulating Windows Firewall logs during engagement cleanup?

11. Which tool is commonly used to clear Windows Event Logs during post-exploitation?

12. In post-exploitation, what does 'persistence' refer to?

13. What is the primary advantage of using legitimate tools (living off the land) for lateral movement?

14. Which Windows service enables remote code execution for lateral movement?

15. What is 'pass-the-hash' primarily used for in lateral movement?

16. Which lateral movement technique uses legitimate system credentials to access other systems?

17. What does the 'last' command in Linux reveal that should be sanitized?

18. In Windows, which registry hive contains user activity and recent file access?

19. Which file stores command history in Linux that should be cleared during cleanup?

20. What is the primary purpose of clearing bash history in Linux post-exploitation?