The answer is hidden processes not visible in Task Manager, as this is a classic indicator of a rootkit infection on a Windows system. Rootkits operate at the kernel level, intercepting system calls like NtQuerySystemInformation to filter out malicious processes from the returned data, which creates inconsistent system calls that reveal the discrepancy between what the OS reports and what is actually running. On the Computer Hacking Forensic Investigator CHFI exam, this concept tests your understanding of kernel-mode rootkits that hook the System Service Dispatch Table (SSDT) to evade detection; a common trap is mistaking a simple user-mode process for a rootkit symptom, but the key is that hidden processes bypass standard enumeration tools like Task Manager while still consuming resources. Remember the mnemonic "HIPS" for Hidden processes, Inconsistent calls, Persistent stealth, and SSDT hooks to recall the core indicators.
CHFI Malware Forensics Practice Question
This CHFI practice question tests your understanding of malware forensics. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which TWO of the following are common indicators of a rootkit infection on a Windows system?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
System calls returning inconsistent results
Option B is correct because rootkits operate at the kernel level, intercepting system calls to hide their presence. When a system call (e.g., NtQuerySystemInformation) is invoked, the rootkit modifies the return data to exclude malicious processes or files, causing the results to be inconsistent with the actual system state. This is a classic symptom of a kernel-mode rootkit that has hooked the System Service Dispatch Table (SSDT).
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
High CPU usage by svchost.exe
Why it's wrong here
High CPU can be due to many reasons, not exclusively rootkits.
✓
System calls returning inconsistent results
Why this is correct
Rootkits hook system calls to return false information.
Related concept
Read the scenario before looking for a memorised answer.
✗
Unexpected open ports on the firewall
Why it's wrong here
Open ports indicate network activity but not specifically rootkits.
✗
Presence of unsigned kernel drivers
Why it's wrong here
Unsigned drivers are a vulnerability but not a direct indicator of infection.
✓
Hidden processes not visible in Task Manager
Why this is correct
Rootkits hide processes from standard system tools.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the distinction between generic malware symptoms (like high CPU or open ports) and rootkit-specific stealth behaviors, so candidates mistakenly choose obvious signs of compromise rather than the subtle, kernel-level inconsistencies that uniquely identify a rootkit.
Detailed technical explanation
How to think about this question
Rootkits often use DKOM (Direct Kernel Object Manipulation) to unlink process objects from the EPROCESS list, making them invisible to tools like Task Manager that rely on the same list. A forensic examiner can detect this by comparing the output of user-mode APIs (e.g., CreateToolhelp32Snapshot) with kernel-mode data structures (e.g., via a memory dump analysis using Volatility's pslist vs. psscan). In real-world cases, the Stuxnet rootkit used signed drivers and manipulated system calls to hide its files and processes, demonstrating that inconsistent system call results are a key forensic artifact.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CHFI question in full detail.
Malware Forensics — This question tests Malware Forensics — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: System calls returning inconsistent results — Option B is correct because rootkits operate at the kernel level, intercepting system calls to hide their presence. When a system call (e.g., NtQuerySystemInformation) is invoked, the rootkit modifies the return data to exclude malicious processes or files, causing the results to be inconsistent with the actual system state. This is a classic symptom of a kernel-mode rootkit that has hooked the System Service Dispatch Table (SSDT).
What should I do if I get this CHFI question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.