SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
After a suspected compromise, a server's local tools report sshd listening on port 22, but netstat and the EDR console fail to show the process that owns the socket. A reboot does not remove the issue, and firmware integrity checks pass. Which malware type is most likely installed?
⚠ Common exam trap
Test-takers frequently confuse persistence with logic bombs or assume that any hidden software is spyware, but the key technical indicator is the ability to hide a socket from netstat and EDR while surviving reboot, which is a hallmark of kernel-level rootkits.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rootkit, because it is designed to hide processes, drivers, or sockets from normal security tools.
A rootkit is specifically designed to hide its presence from the operating system and security tools by intercepting system calls (e.g., those used by netstat and EDR) to conceal processes, drivers, and network sockets. The persistence after reboot and clean firmware integrity checks indicate the rootkit is installed at the kernel or boot level, bypassing user-mode detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Spyware, because hidden software is often used to collect credentials and data.
Why it's wrong here
Spyware is primarily designed to covertly collect user data, such as keystrokes, credentials, or browsing habits, typically through user-space hooks or monitoring APIs. The critical clue here is that a listening socket exists but normal tools cannot attribute it to a process, which implies kernel- or driver-level interception of system calls—far beyond what typical spyware needs to hide its data collection. Spyware generally does not actively subvert process and socket enumeration functions; it relies on quiet operation rather than deep concealment, making rootkit behavior a better match for the observed symptoms.
- ✓
Rootkit, because it is designed to hide processes, drivers, or sockets from normal security tools.
Why this is correct
Rootkit is the best answer because the core clue is stealth: the service exists, but common tools cannot attribute the socket to a process. That suggests kernel- or driver-level concealment rather than a normal user-space infection. The persistence after reboot further supports a deeply embedded implant that survives simple cleanup attempts.
- ✗
Ransomware, because the server remains operational while still hiding evidence.
Why it's wrong here
Ransomware's defining characteristic is encrypting files or disrupting system availability, then demanding ransom—actions that are deliberately visible to pressure the victim. A server that stays fully operational and shows no signs of file encryption, altered access, or extortion notes does not fit that pattern. The presence of a stealthy, unexplained socket is a concealment technique, not an impact-oriented one; ransomware has no reason to hide its activity from netstat or process listings because its objective is to be noticed. Therefore, while the server remains running and evidence is being hidden, those facts alone are not indicators of ransomware behavior.
- ✗
Logic bomb, because the issue persists after reboot and could trigger later.
Why it's wrong here
A logic bomb is a piece of dormant code that triggers a malicious payload only when a specific condition is met, such as a date, a user action, or a system event. Persistence after reboot indicates the malicious code is embedded deeply enough to survive restarts, but it does not imply a delayed trigger mechanism, and no evidence here suggests a pending activation condition. The observed symptom is a hidden, unattributable socket caused by active process and socket hiding—a continuous stealth state, not a conditional future detonation. Thus the persistence after reboot is relevant, but it points to a rootkit's survival mechanism rather than a logic bomb's scheduled or event-based trigger.
Go deeper
Related to this question
Learn chapter
Malware Types and Characteristics
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Persistence
Persistence is the set of techniques attackers use to maintain long-term access to a compromised system even after reboots or credential changes.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. After an endpoint cleanup, an EDR agent shows inconsistent results: a suspicious process does not appear in normal task listings, a file in System32 is hidden from user-mode tools, and some security logs stop recording events at the same time. Which malware type best matches these symptoms?
medium- ✓ A.Rootkit, because it hides processes, files, or activity from standard system tools.
- B.Spyware, because it secretly collects user information and browser data.
- C.Worm, because it spreads quickly through network shares and email attachments.
- D.Trojan, because it masquerades as legitimate software to trick the user.
Why A: A rootkit is designed to hide its presence and the presence of associated processes, files, and system activities from standard operating system tools and user-mode APIs. The symptoms described—a process invisible to task listings, a hidden file in System32, and security logs ceasing to record events—are classic indicators of kernel-mode or user-mode rootkit behavior that intercepts system calls to filter out its own artifacts.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.