On a Linux server, ps, netstat, and ls report nothing unusual, yet an offline scan from trusted boot media reveals a running backdoor binary and an outbound connection that the live system tools never displayed. Which threat is the most likely explanation?
Select an answer to reveal the explanation.
Short Explanation
If the tools you use to look are lying to you, the problem isn't just malware — it's malware that's rewired your eyes. That's a rootkit: it subverts the operating system so ps and netstat report a clean box. Your clue is that only a trusted, offline look found it.
Full Explanation
A rootkit is malware designed to conceal its presence by subverting the operating system itself. User-mode rootkits replace or hook utilities such as ps, ls, and netstat, while kernel-mode rootkits intercept system calls so that every tool asking the kernel receives filtered answers. That is why the backdoor appeared only when the disk was examined from trusted boot media, where the compromised kernel and binaries were not running. Cron-based persistence explains how malware survives a reboot, but an ordinary scheduled job remains visible in process listings and crontab files, so it does not account for tools that lie. A worm scanning neighbors would generate visible connections and spread, and nothing indicates propagation. A logic bomb waits dormant for a trigger, but the scenario shows an active process and a live connection, so it is already executing and is being hidden rather than waiting. Exam caveat: persistence and concealment are different properties; rootkit questions hinge on hiding from the operating system. Operational check: compare live tool output with an offline or memory-forensics view, verify package file hashes against the vendor database, and rebuild the host from known-good media rather than trying to clean it in place.