hardMultiple ChoiceObjective-mapped
220-1202 Practice Question: A technician is investigating a security breach…
A technician is investigating a security breach where sensitive customer data was exfiltrated. The only malware found is a hidden driver that intercepts keystrokes and sends them to a remote server. Which malware type is responsible, and what is the best removal strategy?
⚠ Common exam trap
The CompTIA A+ exam often tests the misconception that any malware that steals data is spyware, but the specific mechanism (hidden driver intercepting keystrokes) points to a keylogger, and the trap is that candidates overlook the need for a rescue disk because they assume a standard antivirus scan can remove kernel-level threats.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Keylogger; use a rescue disk to boot and run an anti-rootkit scanner.
The malware is a hidden driver that intercepts keystrokes and sends them to a remote server, which is the classic behavior of a keylogger. Because it is a driver, it likely operates at the kernel level, making it a rootkit. Standard antivirus scans may miss it because the OS is compromised, so the best removal strategy is to boot from a rescue disk (clean OS) and run an anti-rootkit scanner to detect and remove the driver without the rootkit hiding itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Spyware; remove by running a standard antivirus scan.
Why it's wrong here
Spyware is a broad category, but sophisticated variants, especially those operating at the kernel level or employing rootkit techniques, can evade detection by standard antivirus scans. These advanced threats often hook into system processes or drivers, making them invisible to security software running within the compromised operating system. A standard scan might only detect user-mode spyware, not the stealthier, kernel-level keyloggers implied by the question's context.
- ✓
Keylogger; use a rescue disk to boot and run an anti-rootkit scanner.
Why this is correct
A keylogger operating as a rootkit embeds itself deeply within the operating system's kernel, allowing it to intercept keystrokes while remaining hidden from standard security software. Using a rescue disk allows the system to boot into a clean, uncompromised environment, bypassing the rootkit's stealth mechanisms. From this clean state, an anti-rootkit scanner can effectively detect and remove the malicious kernel-level components without the rootkit actively defending itself.
- ✗
Ransomware; restore from backup.
Why it's wrong here
Ransomware primarily functions by encrypting a victim's files and demanding a ransom for their decryption, rather than intercepting keystrokes. While restoring from backup is a critical recovery step for ransomware attacks, the question's context of investigating a security breach where sensitive data was compromised (implying data exfiltration or direct access) does not align with ransomware's typical operational goal of data unavailability. Ransomware focuses on denying access to data, not covertly logging user input.
- ✗
Adware; uninstall suspicious programs from Control Panel.
Why it's wrong here
Adware typically displays unwanted advertisements, redirects web traffic, or modifies browser settings, but it generally lacks the sophisticated capabilities to log keystrokes or operate as a stealthy kernel-level driver. While uninstalling suspicious programs from the Control Panel is a common method for removing adware, this approach is insufficient for detecting and eradicating advanced, hidden threats like rootkit-based keyloggers. Adware's primary objective is revenue generation through ads, not covert data theft via keystroke capture.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 220-1202 question from scratch — 495 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.