SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Spyware

  Why this is correct

  Spyware is a type of malicious software that covertly monitors user activity and transmits that information to a remote attacker. In this scenario, quietly harvesting browsing data is a hallmark behavior of spyware, which often arrives bundled with free utilities from unofficial sources. Unlike outright destructive malware, spyware focuses on data exfiltration and typically operates in the background without the user's knowledge, making it the best match for the described symptoms.

• ✗

  Ransomware

  Why it's wrong here

  Ransomware is designed to deny the legitimate owner access to their files or system, typically by encrypting critical data and then demanding payment for the decryption key. The scenario describes only the harvesting of browsing data, with no mention of encryption, ransom notes, or loss of file access. Even if ransomware might steal some data as an additional tactic, its defining characteristic is extortion through data lockdown, which is not indicated here.

• ✗

  Worm

  Why it's wrong here

  A worm is a self-replicating malware that spreads independently across networks and devices by exploiting vulnerabilities, often without any user interaction. Its primary goal is propagation, frequently consuming bandwidth or dropping other payloads as it moves from host to host. The symptom here — the theft of browsing data from a single installed utility — lacks any indication of autonomous spread, network propagation, or self-replication, so this option does not fit.

• ✗

  Rootkit

  Why it's wrong here

  A rootkit is a stealthy type of malware designed to hide its own presence or other malicious activity by modifying operating system APIs, kernel drivers, or boot processes, thereby granting an attacker persistent privileged access. While a rootkit can be used to conceal spyware, its core behavior is concealment and unauthorized privilege escalation, not specifically monitoring browsing data or transmitting it. Since the scenario only mentions browsing data being harvested and does not describe hidden processes, privilege escalation, or persistence mechanisms, calling it a rootkit would be incorrect.