An attacker wants to install malware that will give them persistent, hidden, administrator-level control of a victim's operating system while hiding its processes, files, and network activity from normal detection tools. Which type of malware best meets these goals?
The best choice is a rootkit. A rootkit is specifically designed to obtain privileged (root/administrator) access and to conceal itself and any other malicious activity, making detection and removal difficult.
Ransomware encrypts data to extort payment; it may or may not grant ongoing control.
Spyware's primary purpose is to collect information surreptitiously, not to maintain privileged, concealed control.
A Trojan can open a back door or deliver other payloads, but it does not inherently provide the kernel-level stealth and privilege-escalation capabilities that define a rootkit.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is a rootkit and how does it work?
Open an interactive chat with Bash
How does a rootkit differ from other malware like Trojans and viruses?
Open an interactive chat with Bash
What are some signs that a rootkit may be present on a system?