SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Rootkit, because it hides processes, files, or activity from standard system tools.

  Why this is correct

  Rootkits operate by intercepting or modifying system calls, kernel objects, or process lists so that malware artifacts are omitted from standard enumeration tools like Task Manager, netstat, or Get-Process. They can run in kernel mode (e.g., a malicious driver) or user mode (via API hooking), and they actively subvert the operating system's visibility mechanisms. The EDR agent showing inconsistent data after cleanup aligns with a rootkit removing itself from the agent's view or masking residual artifacts, which is exactly the concealment signature described.

• ✗

  Spyware, because it secretly collects user information and browser data.

  Why it's wrong here

  Spyware is primarily a surveillance program that captures keystrokes, browser history, and credentials, but it typically runs as a normal user-mode process that can be seen by Task Manager or endpoint detection tools unless paired with a separate stealth component. Its core behavior is data exfiltration, not actively manipulating the OS to hide processes or files from system utilities. The EDR inconsistency here is a symptom of tampered visibility and concealment, which spyware alone cannot produce; that subversion is the rootkit's job.

• ✗

  Worm, because it spreads quickly through network shares and email attachments.

  Why it's wrong here

  A worm is self-propagating malware that replicates across networks via shared drives, removable media, or email and consumes bandwidth, but it does not inherently alter the local OS's reporting mechanisms to hide its own processes or files. Worms are often detected by unusual network traffic or the sudden appearance of new executables, and their presence is not normally masked from standard system tools. The fact that an EDR agent becomes inconsistent on one host after cleanup points to local stealth and anti-forensics, not to network-based reproduction, so a worm is the wrong classification.

• ✗

  Trojan, because it masquerades as legitimate software to trick the user.

  Why it's wrong here

  A trojan arrives disguised as legitimate software and creates a backdoor for remote access, but once installed it does not automatically possess the ability to hide itself from process listings or file system enumeration. Trojans often rely on separate rootkit components to achieve stealth; the masquerade explains initial infection, not the ongoing concealment of activity. The EDR agent's inconsistent state indicates that something is actively interfering with its visibility into the endpoint, which is a rootkit behavior, not a characteristic of a mere trojan.

Go deeper

Related to this question