312-50V10 · Question #670
Which of the following is the primary objective of a rootkit?
The correct answer is C. It replaces legitimate programs. Rootkits primarily achieve persistence and stealth by replacing legitimate OS programs with malicious versions that conceal the attacker's presence.
Question
Which of the following is the primary objective of a rootkit?
Options
- AIt opens a port to provide an unauthorized service
- BIt creates a buffer overflow
- CIt replaces legitimate programs
- DIt provides an undocumented opening in a program
How the community answered
(40 responses)- A3% (1)
- C95% (38)
- D3% (1)
Why each option
Rootkits primarily achieve persistence and stealth by replacing legitimate OS programs with malicious versions that conceal the attacker's presence.
Opening a port for unauthorized services is the behavior of a backdoor or trojan, not the primary objective of a rootkit.
Creating a buffer overflow is an exploitation technique used to gain initial access, not something a rootkit does after installation.
The defining characteristic of a rootkit is replacing legitimate system binaries (such as ls, ps, or netstat) with trojaned versions that filter output to hide malicious activity. This replacement allows the attacker to maintain control while evading detection by the OS and administrators. The tampered programs report a false clean state to anyone inspecting the system.
Providing an undocumented opening in a program describes a backdoor, which is a separate malware category focused on re-entry rather than stealth through file replacement.
Concept tested: Rootkit definition and primary stealth mechanism
Source: https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/rootkits-malware
Topics
Community Discussion
No community discussion yet for this question.