ITPEC FE Morning April 2020 Question 41
Which of the following is a package of unauthorized programs and tools that have functions such as creating a back door on a server and hiding the evidence of intrusion inside a server?
Explanation
Rootkit — a kit of tools an intruder installs to keep a backdoor open and hide the intrusion.
After gaining administrator (root) privileges, an attacker installs a rootkit. Its tools create a backdoor for later access and conceal the attack: they tamper with logs and replace or hook system commands so that the attacker's files, processes and connections do not show up. The name combines root, the Unix administrator account, with kit.
Answer (b)
Why not others:
- •(a) RFID — radio-frequency identification, which reads data from IC tags without contact; not malware
- •(c) TKIP — Temporal Key Integrity Protocol, the key-management and encryption protocol of WPA wireless LANs
- •(d) Web beacon — a tiny, usually invisible image embedded in a web page or e-mail to track who viewed it; it tracks users but does not intrude into servers
Key rule: A rootkit's hallmark is concealment after intrusion: finding one usually means the system's own tools cannot be trusted, so rebuild from clean media.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.