1. Home
2. All questions
3. Question 475

CompTIA Security+ study material · question 475 of 611

Why should a suspected rootkit infection not be investigated using tools running on the affected host?

• Attacks
• Operational security

1. The host's logs are encrypted
2. The tools would overwrite volatile memory
3. The tools require administrative privileges
4. A rootkit subverts the operating system's reporting, so the host cannot be trusted to report on itself

Challenge yourself on this topic → Study as cards