GIAC GCED Exam - Topic 2 Question 52 Discussion

Actual exam question for GIAC's GCED exam

Question #: 52
Topic #: 2

[All GCED Questions]

Which of the following is a major problem that attackers often encounter when attempting to develop or use a kernel mode rootkit?

ATheir effectiveness depends on the specific applications used on the target system.

BThey tend to corrupt the kernel of the target system, causing it to crash.

CThey are unstable and are easy to identify after installation

DThey are highly dependent on the target OS.

Show Suggested Answer

Suggested Answer: C

Recent versions of IOS have less services enabled by default, older versions vary but generally have more services (even those not needed) enabled by default; this increases the attack surface on the device.

by Valentin at Sep 16, 2024, 06:53 PM

Limited Time Offer

25%

Off

Get Premium GCED Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Tamesha

3 months ago

Wait, are they really that easy to spot after installation?

upvoted 0 times

...

Johnna

3 months ago

B is a big issue, crashing the kernel is a major risk!

upvoted 0 times

...

Abel

3 months ago

I thought they were mostly stable once installed?

upvoted 0 times

...

Kristel

4 months ago

Totally agree, the OS version matters a lot too!

upvoted 0 times

...

Theola

4 months ago

A rootkit's effectiveness really does depend on the target apps.

upvoted 0 times

...

Elinore

4 months ago

I vaguely recall something about how rootkits can be affected by the applications on the system. Maybe option A is relevant, but I'm leaning towards D being more accurate.

upvoted 0 times

...

Donette

4 months ago

I practiced a similar question where we discussed the stability of rootkits. I think option C makes sense because they can be unstable and detectable.

upvoted 0 times

...

Carmela

4 months ago

I'm not entirely sure, but I feel like option B could be a problem too. If they corrupt the kernel, that would definitely cause issues.

upvoted 0 times

...

Jovita

5 months ago

I remember studying that kernel mode rootkits can be really tricky because they interact directly with the operating system. I think option D might be the right answer since they depend on the target OS.

upvoted 0 times

...

Sina

5 months ago

Hmm, I'm not sure about this one. The options all seem plausible, but I'll need to weigh the pros and cons of each before making a decision.

upvoted 0 times

...

Miss

5 months ago

I'm pretty confident I know the answer to this one. Kernel mode rootkits are highly dependent on the target OS, so option D seems like the best choice.

upvoted 0 times

...

Quentin

5 months ago

Okay, I've got a strategy here. I know that kernel mode rootkits are designed to operate at the lowest level of the system, so I'll focus on options that relate to the challenges of that approach.

upvoted 0 times

...

Soledad

5 months ago

I'm a bit confused by this question. What exactly do they mean by "major problem" that attackers encounter? I'll need to read through the options more closely.

upvoted 0 times

...

Emile

5 months ago

Hmm, this seems like a tricky one. I'll have to think carefully about the different options and how they relate to kernel mode rootkits.

upvoted 0 times

...

Lashunda

5 months ago

I'm a bit confused by the options. I'll need to double-check the RADIUS authentication settings and user role definitions to make sure I select the correct choices.

upvoted 0 times

...

Honey

9 months ago

Well, I guess the attackers really need to do their homework on the target OS. Option D sounds like the way to go if you want to avoid a nasty kernel corruption surprise.

upvoted 0 times

Fausto

8 months ago

User 3: Their effectiveness really depends on the OS they are targeting.

upvoted 0 times

...

Leanna

8 months ago

User 2: Yeah, attackers really need to be careful with the target OS.

upvoted 0 times

...

Della

8 months ago

User 1: Option D sounds like the way to go if you want to avoid a nasty kernel corruption surprise.

upvoted 0 times

...

Meaghan

9 months ago

I'm going with option A. Those pesky rootkits never seem to work quite right on my system. Must be the special apps I use. *wink wink*

upvoted 0 times

...

Buck

9 months ago

Haha, I bet the attackers wish they could just use a nice, stable rootkit that doesn't crash the system. Option B sounds like a classic case of 'rootkit, meet BSOD'.

upvoted 0 times

Irma

9 months ago

D) They are highly dependent on the target OS.

upvoted 0 times

...

Annice

9 months ago

C) They are unstable and are easy to identify after installation

upvoted 0 times

...

Nadine

9 months ago

B) They tend to corrupt the kernel of the target system, causing it to crash.

upvoted 0 times

...

Gabriele

9 months ago

A) Their effectiveness depends on the specific applications used on the target system.

upvoted 0 times

...

Mollie

10 months ago

I disagree, I think option C is the correct answer. Kernel mode rootkits are known to be unstable and easy to detect after installation, which makes them a major problem for attackers.

upvoted 0 times

Fidelia

9 months ago

C) They are unstable and are easy to identify after installation

upvoted 0 times

...

Maryrose

9 months ago

B) They tend to corrupt the kernel of the target system, causing it to crash.

upvoted 0 times

...

Ora

9 months ago

A) Their effectiveness depends on the specific applications used on the target system.

upvoted 0 times

...

Jettie

10 months ago

I think option D is the correct answer. Kernel mode rootkits are highly dependent on the target OS, and will not work on systems with different kernel versions or architectures.

upvoted 0 times