SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A remote user's laptop begins launching a legitimate-looking "System Update" application at login. After the update window appears, the browser homepage changes, outbound traffic increases, and the user later reports that saved passwords are being used in unauthorized logins. Which malware type is the most likely primary infection?
⚠ Common exam trap
Many candidates confuse the visible symptoms (browser change, increased traffic) with a worm's network propagation or a rootkit's stealth, but the key indicator is the social engineering disguise of the 'System Update' application, which is the hallmark of a Trojan.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Trojan, because it is disguised as a harmless utility while delivering malicious payloads.
The malware is disguised as a legitimate 'System Update' application, which is the classic behavior of a Trojan. Trojans rely on social engineering to trick users into executing them, and once activated, they can deliver secondary payloads such as password stealers, browser hijackers, or backdoors. In this scenario, the Trojan likely installed a keylogger or credential harvester to exfiltrate saved passwords, changed browser settings via registry or configuration file manipulation, and increased outbound traffic to a command-and-control (C2) server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Worm, because it is spreading automatically to nearby systems on the network.
Why it's wrong here
A worm is self-replicating malware that spreads autonomously across networks by exploiting vulnerabilities or using social engineering to send itself to other hosts, often requiring no user action after initial execution. The scenario describes a single affected laptop with a fake updater and browser changes, but no evidence of propagation to nearby systems or across the network. The absence of worm-like self-replication and lateral movement makes this classification incorrect for the observed symptoms.
- ✓
Trojan, because it is disguised as a harmless utility while delivering malicious payloads.
Why this is correct
A trojan is malicious software that disguises itself as a legitimate program, such as a software update or utility, to trick a user into installing it. Once executed, it can carry out hidden actions like credential theft, establishing persistence, or downloading additional payloads, which aligns with the observed fake updater and browser modifications. The user's voluntary execution of the seemingly harmless file is the key vector, distinguishing it from other malware types.
- ✗
Ransomware, because files would be encrypted and a payment demand would appear.
Why it's wrong here
Ransomware is designed to encrypt a victim's files or lock the system, then display a conspicuous ransom demand to extort payment, typically changing file extensions or leaving ransom notes. The scenario lacks any description of file encryption, system locking, or an explicit payment demand, and instead focuses on a deceptive updater and browser changes. Without those hallmark extortion behaviors, ransomware is not a plausible classification for this incident.
- ✗
Rootkit, because the malware is hiding its own presence by modifying kernel behavior.
Why it's wrong here
A rootkit is a collection of tools engineered to achieve stealth by subverting the operating system kernel or system APIs, thereby hiding malicious processes, files, and registry keys from standard detection mechanisms. The symptoms in the scenario—a visible fake updater and browser modifications—are overt and user-observable, whereas a rootkit's core purpose is concealment and remaining undetected. The lack of stealth behavior and the presence of deceptive but visible execution point more directly to a trojan.
Go deeper
Related to this question
Learn chapter
Malware Types and Characteristics
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
Key term
Trojan
A Trojan is a type of malware that disguises itself as a legitimate file or program to trick users into installing it, then performs harmful actions without the user's knowledge.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.