CompTIA Security+ Exam Prep

Answer - A - Rootkits are software programs that have the ability to hide certain processes and connections from the operating system.

Key Takeaway: A rootkit is a software system consisting of one or more programs designed to obscure the fact that a system has been compromised. An attacker may use a rootkit to replace vital system executables, which may then be used to hide processes and files the attacker has installed, along with the presence of the rootkit. This hidden stuff does not show up in Task Manager or the netstat display. It manipulates function calls to the operating system and filters out information that would appear when a computer is functioning normally.