CND Endpoint Protection Practice Question
An Incident Response team is investigating a Linux server where a persistent backdoor is suspected of hiding process IDs (PIDs) using user-space hooks. Which utility should the responder use to compare process lists returned by the kernel system call table against direct kernel memory inspection?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
unhide
rkhunter or chkrootkit can check for hidden processes, but specialized tools like unhide directly compare ps/top outputs with direct procfs/syscall examination to detect hidden PIDs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
unhide
Why this is correct
unhide is a forensic tool designed to find hidden processes and ports affected by rootkits manipulating the system call table.
- ✗
lsof -i
Why it's wrong here
lsof queries standard file descriptors and open sockets, which are similarly blinded by kernel-level hooks.
- ✗
netstat -anp
Why it's wrong here
netstat relies on standard OS socket tables which can be spoofed or hidden by user-space rootkits.
- ✗
ps aux --forest
Why it's wrong here
ps relies on the standard proc filesystem, which can be hooked and manipulated by rootkits.
About these practice questions
One of 323 original CND practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CND practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CND exam.