Which tool can be used to check for rootkits on a Linux system?

The correct answer is A. chkrootkit. chkrootkit is a dedicated command-line tool designed specifically to scan a Linux system for known rootkits, suspicious files, and signs of compromise - making it the direct answer here. AIDE (Advanced Intrusion Detection Environment) is a file integrity checker that detects…

Host Security

Question

Options

Achkrootkit
BAIDE
COpenSCAP
Drpm

How the community answered

(59 responses)

A
92% (54)
B
2% (1)
C
2% (1)
D
5% (3)

Explanation

chkrootkit is a dedicated command-line tool designed specifically to scan a Linux system for known rootkits, suspicious files, and signs of compromise - making it the direct answer here.

AIDE (Advanced Intrusion Detection Environment) is a file integrity checker that detects unauthorized changes to files, but it doesn't scan for rootkits specifically. OpenSCAP is a compliance and vulnerability scanning framework based on security policies/benchmarks - useful for auditing, not rootkit detection. rpm is simply the Red Hat package manager used to install/query/verify packages, with no rootkit-hunting capability.

Memory tip: Think of the "rk" in chkrootkit as standing for "rootkit killer" - it's the tool with "rootkit" literally in its name, so if the question is about rootkits, pick the tool that says so.

Topics

#rootkit detection#chkrootkit#malware detection#host monitoring

Community Discussion

No community discussion yet for this question.

Full 303-300 Practice