CAS-004 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  pslist

  Why it's wrong here

  pslist walks the active process list, which a rootkit can unlink from, so hidden processes simply will not appear. It is the right starting plugin for enumerating visible processes and their PIDs, but detecting DKOM unlinked processes requires psscan, which carves pool tags instead.

• ✓

  psxview

  Why this is correct

  psxview cross-references multiple process-listing sources, including EPROCESS linked lists, CSRSS handles and session structures, exposing processes hidden from any single view. Rootkits unlink entries from the standard list, so this plugin's comparison directly satisfies the requirement to detect hidden processes.

• ✗

  malfind

  Why it's wrong here

  malfind scans process memory for injected code and suspicious protection flags such as PAGE_EXECUTE_READWRITE; it does not enumerate processes, so unlinked rootkit processes stay undetected. It is the right plugin for locating injected shellcode or hollowed regions once a suspicious process is already identified.

• ✗

  pstree

  Why it's wrong here

  pstree renders parent-child relationships from the same linked list pslist uses, so unlinked rootkit processes remain invisible. It is the correct choice for visualising process ancestry and spotting odd parentage, but it cannot expose processes removed from the active list.