What is a rootkit?

What is a rootkit?

• A. A firewall rule set
• B. A hardware device
• C. A collection of tools (programs) that a hacker uses to mask intrusion
• D. A type of encryption algorithm

Answer: (C)

A rootkit is a collection of tools that a hacker uses to hide intrusion and maintain access to a compromised system. Its primary purpose is stealth: it conceals the attacker’s presence by masking processes, files, network connections, and even logs, often by manipulating operating system internals or loading at the kernel level. This stealth enables persistence, so the attacker can regain control after reboots or other attempts at removal. In other words, a rootkit is designed to keep the intrusion hidden while the attacker stays in control. That’s why describing it as a set of programs used to mask an intrusion fits best. A firewall rule set is about controlling traffic, not concealing an intrusion. A hardware device is a physical component, not the software toolkit that hides activity. An encryption algorithm is about protecting data, not hiding unauthorized access.

A rootkit is a collection of tools that a hacker uses to hide intrusion and maintain access to a compromised system. Its primary purpose is stealth: it conceals the attacker’s presence by masking processes, files, network connections, and even logs, often by manipulating operating system internals or loading at the kernel level. This stealth enables persistence, so the attacker can regain control after reboots or other attempts at removal. In other words, a rootkit is designed to keep the intrusion hidden while the attacker stays in control.

That’s why describing it as a set of programs used to mask an intrusion fits best. A firewall rule set is about controlling traffic, not concealing an intrusion. A hardware device is a physical component, not the software toolkit that hides activity. An encryption algorithm is about protecting data, not hiding unauthorized access.