GSLC · Question #423
John works as a professional Ethical Hacker. He is assigned a project to test the security of Which of the following statements are true about rootkits? Each correct answer represents a complete…
The correct answer is B. They allow an attacker to replace utility programs that can be used to detect the attacker's activity. C. They allow an attacker to set a Trojan in the operating system and thus open a backdoor for anytime access. D. They allow an attacker to run packet sniffers secretly to capture passwords. Rootkits are post-exploitation toolkits that provide persistent, hidden access by subverting OS utilities, installing backdoors, and concealing attacker processes - but they do not themselves perform initial exploitation techniques like buffer overflows.
Question
John works as a professional Ethical Hacker. He is assigned a project to test the security of Which of the following statements are true about rootkits? Each correct answer represents a complete solution. Choose all that apply.
Options
- AThey allow an attacker to conduct a buffer overflow.
- BThey allow an attacker to replace utility programs that can be used to detect the attacker's activity.
- CThey allow an attacker to set a Trojan in the operating system and thus open a backdoor for anytime access.
- DThey allow an attacker to run packet sniffers secretly to capture passwords.
How the community answered
(28 responses)- A11% (3)
- B89% (25)
Why each option
Rootkits are post-exploitation toolkits that provide persistent, hidden access by subverting OS utilities, installing backdoors, and concealing attacker processes - but they do not themselves perform initial exploitation techniques like buffer overflows.
Buffer overflow is an initial exploitation technique used to gain code execution or escalate privileges; it is a separate attack vector and not a capability that a rootkit provides once installed.
A core rootkit capability is replacing or trojaning system binaries (such as ps, ls, and netstat) so that the attacker's files, processes, and network connections are hidden from administrators and security tools.
Rootkits commonly embed Trojan components or backdoor services directly into the operating system, enabling persistent covert re-entry for the attacker at any time without re-exploiting the system.
Because rootkits can suppress process and file visibility at the kernel or user level, they allow packet sniffers to run invisibly, capturing passwords and sensitive network data without triggering detection.
Concept tested: Rootkit capabilities and post-exploitation persistence mechanisms
Source: https://csrc.nist.gov/glossary/term/rootkit
Topics
Community Discussion
No community discussion yet for this question.