Which rootkit is described as a hardware or firmware rootkit that can evade code integrity checks?

• A. Hardware/Firmware Rootkit
• B. Library Level Rootkits
• C. Boot Loader Level Rootkit
• D. Hypervisor Level Rootkit

Answer: (A)

This describes a rootkit that hides outside the operating system, in firmware or hardware. Because code integrity checks typically verify the software and kernel modules loaded by the OS, a rootkit resident in firmware or hardware can operate below that layer and present a clean image to the system. That placement lets it persist across reboots and even some updates, while evading standard integrity protections.

In contrast, library-level, boot loader level, or hypervisor-level rootkits live at higher software layers or in the virtualization layer, and while they are stealthy, they don’t inherently bypass firmware/hardware integrity controls in the same way. The hardware/firmware variant is the best fit for evading code integrity checks because it operates outside the scope of those checks. To defend against this, measures like secure boot, firmware/BIOS integrity verification, and hardware-level attestation are essential.