Examkin

Soru

Zorluk: KolayMalware Types and Indicators of Compromise

During a security investigation on a compromised server, an administrator suspects a rootkit has been installed to maintain stealthy persistence. Which TWO of the following indicators of compromise specifically signal the presence of a rootkit?

  1. Discrepancies between low-level kernel queries and user-space administrative process listingsCevap
  2. Interception and modification of system calls to conceal specific files and active network connectionsCevap
  3. C
    Autonomous network scanning traffic targeting vulnerable SMB services across adjacent subnets
  4. D
    Configuration of host firewall rules to restrict inbound ICMP request traffic

Cevap

The correct indicators of a rootkit are discrepancies between low-level kernel queries and user-space process listings, as well as the interception and modification of system calls to conceal files and network connections.
Rootkits achieve stealth by replacing or modifying operating system components and hooking system call interfaces. This creates discrepancies between raw kernel state and user-space management utilities, hiding malicious files, processes, and active network connections from administrators.

Adım Adım Çözüm

1
Analyze the core operating behavior of a rootkit
Rootkits focus on stealth and persistent access by modifying OS system routines or kernel tables.
Understanding rootkit design helps identify how their indicators differ from standard user-mode malware.
2
Evaluate system call and process listing telemetry
Because rootkits hook OS system calls, native reporting tools display sanitized outputs that contradict direct kernel memory queries.
This discrepancy directly identifies rootkit concealment activities.

Anahtar Kavram

Rootkit Indicators of Compromise and Kernel-Level Concealment
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Malware Types and Indicators of Compromise

Bu konudan daha fazla soru