ITPEC FE Subject A April 2024 Question 28
Which of the following is a package of unauthorized programs and tools that has functions such as creating a backdoor on a server and hiding the evidence of intrusion inside the server?
Explanation
Rootkit — a kit of tools an intruder installs to keep a backdoor open and hide the intrusion.
After gaining administrator (root) privileges, an attacker installs a rootkit. Its tools create a backdoor for later access and conceal the attack: they tamper with logs and replace or hook system commands so that the attacker's files, processes and connections do not show up. The name combines root, the Unix administrator account, with kit.
Answer (b)
Why not others:
- •(a) RFID — radio-frequency identification, which reads data from IC tags without contact; not malware
- •(c) TKIP — Temporal Key Integrity Protocol, the key-management and encryption protocol of WPA wireless LANs
- •(d) Web beacon — a tiny, usually invisible image embedded in a web page or e-mail to track who viewed it; it tracks users but does not intrude into servers
Key rule: A rootkit's hallmark is concealment after intrusion: finding one usually means the system's own tools cannot be trusted, so rebuild from clean media.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.