SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Trojan, because it could have introduced the suspicious service after the initial compromise.

  Why it's wrong here

  A trojan is malware disguised as legitimate software, often used to deliver a payload such as a backdoor or another malicious component. While a trojan could have introduced the suspicious service or kernel module, the observed behavior—kernel-level tampering that hides processes and files from standard administrative tools—is the defining characteristic of a rootkit, not a trojan. The question focuses on identifying the current type of malware based on its symptoms, not the initial infection vector; the mechanism of concealment is the strongest clue.

• ✗

  Spyware, because it may collect data while leaving the application functional.

  Why it's wrong here

  Spyware is designed to covertly monitor user activity, capture keystrokes or browsing data, and exfiltrate that information to an attacker, typically while leaving the underlying application or system functional. Although spyware may employ some stealth, it normally runs in user mode and does not install a boot-loaded kernel module that intercepts system calls to hide arbitrary processes and files from process listings and directory enumeration. The scenario's signature is comprehensive OS-level concealment—processes invisible to ps/top and files visible only via raw disk access—which is a rootkit behavior, not simple data collection.

• ✓

  Rootkit, because kernel-level components are hiding processes and files from normal user-mode visibility.

  Why this is correct

  A rootkit is the best answer because the evidence points to concealment at the operating system level. A kernel module loaded at boot, missing processes in standard listings, and files visible only through raw disk examination all indicate malicious hiding behavior. Rootkits are designed to obscure other malware or unauthorized access, making them especially dangerous and difficult to detect with normal administrative tools.

• ✗

  Logic bomb, because the malware activates after startup and changes what administrators see.

  Why it's wrong here

  A logic bomb is malicious code that remains dormant until a specific condition is met, such as a date, time, user action, or system event, at which point it triggers a destructive or unauthorized payload. This scenario includes no triggering condition or delayed activation; instead, the malware continuously operates from boot to hide processes and files through a kernel module. The persistent, ongoing nature of the concealment, along with kernel-level manipulation that alters what administrators see, points directly to a rootkit rather than a condition-triggered logic bomb.