GCIH: GIAC Certified Incident HandlerDemo

Question

John is a professional Ethical Hacker assigned to test the security of www.weare-secure.com. He installs a rootkit on the Linux server in the We-are-secure network. Which of the following statements are true about rootkits?

Each correct answer represents a complete solution.

Choose three

A They allow an attacker to conduct a buffer overflow.
B They allow an attacker to set a Trojan in the operating system and thus open a backdoor for anytime access.
C They allow an attacker to replace utility programs that can be used to detect the attacker's activity.
D They allow an attacker to run packet sniffers secretly to capture passwords.

Explanation

Rootkits operate with elevated privileges to maintain access while concealing malicious software and its activity. They can support hidden backdoors or Trojans, alter or replace operating-system utilities and their reported results to evade detection, and conceal credential-capturing tools such as packet sniffers. A buffer overflow is an initial exploitation method, rather than a rootkit function.

Learn more

GCIH: GIAC Certified Incident HandlerDemo

AstroTutor

Notes

Readiness

QuestionQ654

Community Discussion