What action involves modifying or deleting logs to remove evidence of intrusion?

• A. Gaining Access
• B. Escalating Privileges
• C. Covering Tracks
• D. Executing Applications

Answer: (C)

Covering tracks means tampering with or deleting logs and other evidence to hide what happened during an intrusion. By altering timestamps, clearing log files, or suppressing log generation, an attacker tries to erase footprints so investigators can’t easily reconstruct the attack timeline, techniques used, or entry point. This is a classic defense-evasion tactic aimed at staying undetected.

Gaining access describes breaking in or authentication to a system, not specifically about removing evidence. Escalating privileges is about obtaining higher rights after initial access, not about hiding traces. Executing applications is simply running software, which may be part of an attack but isn’t the act of concealment itself.