CompTIA Security+ Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 25

  D. A rootkit was deployed. A change in the hash of a critical system file like cmd.exe, without any corresponding patches or updates being applied, is a strong indicator of potential malicious activity. A rootkit is a type of malware that can modify system files and hide its presence to maintain persistent and privileged access to a system. If a rootkit has altered cmd.exe, it could be an attempt to replace the legitimate command prompt with a malicious version, or to modify its behavior for nefarious purposes. This is a serious security concern and should be investigated immediately.

• Chose D6

  Changes to the hash of system files, such as cmd.exe, without corresponding patching activity, are often indicative of unauthorized modifications, such as those caused by malware or rootkits. Rootkits are malicious software designed to conceal their presence or the presence of other malware on a system. They often modify system files like cmd.exe to maintain persistence and evade detection.

• Chose D8

  A rootkit can be snuck into a system, & provide functions for an attacker to tamper with system configuration settings without the knowledge of owners, or system administrators.