GIAC GCIH Exam - Topic 5 Question 53 Discussion

Actual exam question for GIAC's GCIH exam

Question #: 53
Topic #: 5

Which of the following types of rootkits replaces regular application binaries with Trojan fakes and modifies the behavior of existing applications using hooks, patches, or injected code?

AApplication level rootkit

BHypervisor rootkit

CKernel level rootkit

DBoot loader rootkit

Show Suggested Answer

Suggested Answer: A

by Terry at Apr 01, 2026, 09:05 PM

Limited Time Offer

25%

Off

Get Premium GCIH Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Elvis

2 days ago

Really? I didn’t know application level rootkits could do that!

upvoted 0 times

...

Renea

7 days ago

I thought Boot loader rootkits were more common, but this makes sense.

upvoted 0 times

...

Becky

12 days ago

Wait, are we sure it’s not Kernel level? That one’s tricky!

upvoted 0 times

...

Jules

2 months ago

Totally agree, it’s all about those application binaries.

upvoted 0 times

...

Noble

2 months ago

A) Application level rootkit is the right answer!

upvoted 0 times

...

Honey

3 months ago

I’m leaning towards A as well, but I keep mixing up the definitions of the different types. I should have reviewed those examples more thoroughly.

upvoted 0 times

...

Yoko

3 months ago

I’m a bit confused between application level and kernel level rootkits. They both seem to modify behavior, but I feel like application level is more about the binaries.

upvoted 0 times

...

Ben

3 months ago

I remember practicing a question like this, and I think the answer was related to how the rootkit interacts with applications. Could it be A?

upvoted 0 times

...

Tracey

3 months ago

I think this might be the application level rootkit, but I'm not entirely sure. It sounds familiar from the study materials.

upvoted 0 times

...