A systems administrator receives the following alert from a file integrity monitoring tool: The hash of the cmd.exe file has changed. The systems administrator checks the OS logs and notices that no…

The correct answer is D. A rootkit was deployed. A rootkit is a type of malware that modifies or replaces system files or processes to hide its presence and activity. A rootkit can change the hash of the cmd.exe file, which is a command-line interpreter for Windows systems, to avoid detection by antivirus or file integrity…

Submitted by khalil_dz· Mar 6, 2026Security Operations

Question

A systems administrator receives the following alert from a file integrity monitoring tool:

The hash of the cmd.exe file has changed. The systems administrator checks the OS logs and notices that no patches were applied in the last two months. Which of the following most likely occurred?

Options

AThe end user changed the file permissions.
BA cryptographic collision was detected.
CA snapshot of the file system was taken.
DA rootkit was deployed.

How the community answered

(34 responses)

A
18% (6)
B
6% (2)
C
9% (3)
D
68% (23)

Explanation

A rootkit is a type of malware that modifies or replaces system files or processes to hide its presence and activity. A rootkit can change the hash of the cmd.exe file, which is a command-line interpreter for Windows systems, to avoid detection by antivirus or file integrity monitoring tools. A rootkit can also grant the attacker remote access and control over the infected system, as well as perform malicious actions such as stealing data, installing backdoors, or launching attacks on other systems. A rootkit is one of the most difficult types of malware to remove, as it can persist even after rebooting or reinstalling the OS.

Community Discussion

No community discussion yet for this question.

Full SY0-701 Practice