What can a hacker destroy or modify to make a server or network intrusion undetectable?
A.
User accounts
B.
Log files
C.
Operating systems
D.
Passwords
Explanation:
Log files keep an audit trail of system activity. If a hacker wanted to cover his tracks, then destroying the log files will remove any footprints or traces of the hacker ever being there.
Incorrect Answers:
A: User accounts that are created or destroyed, or even changed, are usually audited and logged. So, examination of the log files will show that someone was doing this activity, and nothing is left undetected.
B: If the hacker destroys the operating system, someone will know because the system will be down. If the system is modified, then that modification will show up in a log file somewhere, and examination of the logs will show a trail of changes.
D: Modification of passwords will not hide the fact that someone got into the system. It might actually tip someone off that there was an intrusion when someone can no longer log onto their account because the password no longer works.