What may indicate the presence of a rootkit on a system?

• A. Any deviations in the system's normal activity or behavior
• B. Regular backups and maintenance
• C. Consistent performance with no errors
• D. Normal boot times

Answer: (A)

Rootkits work by hiding themselves inside the system, so they’re often difficult to spot directly. What you can usually rely on is that they disturb normal behavior in some way. Any deviations from how the system normally acts—unexplained processes or drivers, hidden or suddenly appearing files, odd startup entries, unusual network connections, or unusual spikes in resource use—can signal that something unusual is running and deserves investigation.

Regular backups and maintenance are good security practices but don’t indicate a rootkit is present. Consistent performance with no errors and normal boot times can occur in a clean system and aren’t reliable indicators of a rootkit by themselves. The key idea is that anomalous behavior is the most likely telltale sign of a rootkit.