ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Rootkits can tamper with the operating system at a very low level, hiding their files, processes, and kernel modules from utilities that run inside the infected machine. The safest way to eradicate them is to shut the instance down, boot it in a trusted rescue or forensic environment, and compare its binaries to a known-good baseline, replacing anything that was modified. Relying on in-guest tools (package managers, kernel updates, or security services) is risky because the rootkit can intercept or falsify their output. External monitoring such as GuardDuty may alert you to the infection but will not by itself remove the malicious code.