Question 1,115 of 1,013
SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
Exhibit
Administrator checks a suspected host: tasklist /svc | findstr vpn (no output) netstat -ano | findstr 51433 TCP 0.0.0.0:51433 0.0.0.0:0 LISTENING 4 driverquery /v | findstr /i kbdflt2 kbdflt2.sys Unknown C:\Windows\System32\drivers\kbdflt2.sys EDR note: Process enumeration from user mode does not match kernel event telemetry.
Based on the exhibit, which malware type best explains the behavior?
⚠ Common exam trap
Candidates often confuse a rootkit's stealth capabilities with a Trojan's deceptive delivery method, failing to recognize that the exhibit's focus on hiding and persistence at the OS level is unique to rootkits, not general malware types.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rootkit
A rootkit is designed to hide its presence and the presence of other malware by modifying the operating system's kernel or system calls, allowing it to evade detection by security tools. The exhibit likely shows behavior such as file hiding, process concealment, or system call interception, which are hallmarks of rootkit activity. This aligns with the SY0-701 objective on understanding malware types and their characteristics.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Trojan
Why it's wrong here
A trojan is malicious software that disguises itself as a legitimate application to trick a user into installing it, often relying on social engineering. The exhibit, however, shows active concealment at the kernel level — an unsigned driver, a hidden listener tied to PID 4, and conflicting user-mode versus kernel telemetry. This behavior is the defining trait of a rootkit, not the initial-vector deception that characterizes a trojan.
- ✓
Rootkit
Why this is correct
The exhibit shows a hidden listener associated with PID 4, an unsigned driver, and a mismatch between user-mode process enumeration and kernel telemetry. Those are classic rootkit indicators because rootkits operate at a low level to conceal processes, ports, or files from standard tools. The suspicious driver name and kernel-level inconsistency are especially strong clues that the malware is trying to hide itself from the operating system and defenders.
- ✗
Logic bomb
Why it's wrong here
A logic bomb lies dormant until a specific condition or date/time triggers a destructive payload, such as file deletion, encryption, or disruption. Nothing in the exhibit indicates a delayed or conditional trigger; instead, the malware is actively running and actively hiding its presence through kernel-level mechanisms. The exhibit’s signature is ongoing stealth and communication, not the scheduled detonation that defines a logic bomb.
- ✗
Spyware
Why it's wrong here
Spyware is typically user-mode software focused on covertly capturing data — keystrokes, credentials, browsing activity — and exfiltrating it to an attacker. While stealthy, spyware rarely installs unsigned kernel drivers or causes the System process (PID 4) to host hidden network listeners, which are hallmarks of a rootkit subverting the operating system’s own reporting. The exhibit demonstrates concealment from security tooling at a fundamental layer, far beyond spyware’s data-gathering scope.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.