SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A workstation starts failing security checks. The antivirus service no longer appears in the running process list, a known driver's hash does not match the vendor's value, and a task manager view shows fewer processes than expected. The user also reports that local admin tools behave inconsistently. What type of malware is most likely present?
⚠ Common exam trap
Many exam-takers confuse a rootkit with a trojan because both can be stealthy, but the specific clues—driver hash mismatch and hidden processes—point to kernel-level manipulation unique to rootkits, not the user-level deception of a trojan.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rootkit
The symptoms—antivirus service missing from the process list, a known driver's hash mismatch, fewer processes in Task Manager, and inconsistent admin tool behavior—are classic indicators of a rootkit. Rootkits operate at kernel or driver level, allowing them to hide processes, files, and registry keys from standard system tools, and they often tamper with driver hashes to evade integrity checks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Spyware
Why it's wrong here
Spyware is primarily focused on covert information gathering — such as keystroke logging, screen capturing, or credential theft — without necessarily altering the operating system's core. While it may attempt to disable security tools, it does not normally intercept kernel-level APIs to hide its own processes or produce hash mismatches in system binaries. The symptoms described point to active concealment of system objects and file integrity violations, behaviors characteristic of a rootkit, not spyware.
- ✓
Rootkit
Why this is correct
A rootkit is purpose-built to maintain privileged, stealthy access by manipulating the OS kernel, drivers, or core system files. It hooks system calls to hide malicious processes from the process list and may patch legitimate binaries, causing antivirus hash checks to fail. The workstation's failure of security checks due to missing processes and hash mismatches is the classic signature of a rootkit infection, as other malware types rarely exhibit this combination of systemic concealment and integrity violation.
- ✗
Trojan
Why it's wrong here
A trojan achieves initial infection by masquerading as desirable legitimate software, but the described symptoms are entirely about post-infection concealment and compromised system integrity. Trojans typically operate at user level after being executed, often creating backdoors or stealing data, but they lack rootkit-style kernel-level mechanisms to filter process listings or modify system files so precisely that hash comparisons fail. Thus, while a trojan could be the initial vector, the observed behavior itself aligns with a rootkit, making 'trojan' an insufficient classification for these specific symptoms.
- ✗
Logic bomb
Why it's wrong here
A logic bomb is a piece of code that lies dormant until a specific condition, such as a date or user action, triggers its malicious payload — often something destructive like data deletion. By design, a logic bomb does not actively hide its own processes, intercept system calls, or modify system binaries to evade detection; it simply waits. The persistent stealth, missing processes, and antivirus hash mismatches described here are symptoms of immediate, ongoing concealment, which a logic bomb does not provide.
Go deeper
Related to this question
Learn chapter
Malware Types and Characteristics
Key term
Integrity
Integrity is the assurance that data has not been altered or tampered with in an unauthorized way, preserving its accuracy and consistency from source to destination.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.