CompTIA SY0-701 Bundle

Spyware quietly collects information about device or user activity and sends it to an unauthorized recipient. The affected host here exploits the same service on nearby systems without another user launching the code, which is evidence about propagation. No covert data collection, browser tracking, or surveillance objective is stated. A worm could carry spyware as a payload, but the observed self-spreading mechanism is what the question asks to classify.

Ransomware commonly encrypts or blocks access to resources and demands payment or another concession, and it can spread using automated exploitation. This case, however, gives only a host that autonomously attacks neighboring services and establishes new infections. No encryption, lockout, payment note, or extortion motive is described. The ability to self-propagate is a defining worm behavior, while ransomware identifies a different payload outcome. A single malware specimen could exhibit both, but the provided evidence supports only the spread classification.

A Trojan disguises a malicious program as legitimate software and relies on the user accepting or launching that disguise. The scenario contains no counterfeit installer or deceptive application presentation. It specifically notes that additional infections happen without fresh user execution, which is strong evidence of autonomous propagation. Trojan functionality could be present in the first infection, but that unobserved entry behavior does not explain how the malware reaches neighboring systems.

Keylogging malware records keyboard input to capture information such as passwords and session-related text. The purported conferencing app installs remote-access malware when launched, but no keystroke capture is described. Remote-control capabilities and keylogging can coexist, yet the evidence emphasizes the deceptive packaging and execution of the malicious installer. Classifying it as a keylogger would assume an unobserved payload feature instead of identifying the visible Trojan delivery mechanism.

Ransomware restricts data or system availability to extort victims, often using encryption and payment demands. The fake conferencing installer is said to install remote-access malware, not encrypt files, disable backups, or present a ransom note. A remote-access payload might later deploy ransomware, but no such progression is included. The current evidence supports a disguised application carrying malware rather than an extortion outcome.

A worm spreads autonomously between systems, typically by exploiting accessible services, with little or no additional user interaction. In this case a person runs a purported conferencing installer, which then installs a remote-access payload. The case does not show that the program independently infects neighboring hosts. Malware can combine Trojan packaging with worm propagation, but the demonstrated property is disguise during installation, not autonomous network spread.

A Trojan is malicious software that disguises itself as benign or desired software; the characteristic is deceptive appearance or delivery. The unauthorized browser extension could have been disguised to obtain installation, but the question does not describe how it was marketed. Its clear observed function is covert tracking and external transmission of browsing history. Therefore spyware is the more specific classification based on what the installed extension actually does rather than an inferred packaging tactic.

Keylogging malware specifically captures keystrokes, which may reveal usernames, passwords, and communications as they are typed. The extension here records visited sites and browsing history, not keyboard input or individual key events. Both are forms of unauthorized surveillance, so the categories can overlap in some tools, but the exact observation distinguishes general spyware from a keylogger. Classifying it as keystroke capture would add a monitoring mechanism that the evidence does not show.

A rootkit typically hides malicious components by tampering with operating-system visibility, privileged hooks, or trusted inspection mechanisms. The browser extension quietly sends history, but the question does not report kernel-level concealment, hidden processes, or modified system APIs. Spyware can operate without a rootkit and without administrator privileges. Silence or lack of user awareness alone is insufficient evidence that a stealth framework has modified operating-system reporting.

A logic bomb contains malicious instructions that activate only after a configured condition, such as a date, account change, or lifecycle event. The process here hooks keyboard input and immediately exports captured credentials. No delayed trigger or separate activation condition is described. Malware might have both a trigger and a collection payload, but the observed behavior is continuous keystroke interception rather than conditional activation.

A rootkit focuses on hiding software, processes, files, or network activity by undermining ordinary inspection mechanisms, often with privileged access. The question shows an endpoint process intercepting keyboard input and sending credentials out; it does not say that processes or hooks are concealed from system tools. Kernel-level interception is possible for some keyloggers, but a keylogger's input capture is not automatically proof of rootkit stealth. The specific operation demonstrated is credential keystroke recording.

Spyware is the broader category of software that collects personal or behavioral information without adequate authorization. A keylogger is therefore often a specialized form of spyware, and this choice is conceptually related. However, the question names the exact mechanism: hooking keyboard input to capture credentials. The more precise classification is keylogging malware rather than spyware in general. A spyware tool that only records browsing history would not demonstrate that same input-capture behavior.

A rootkit is designed to conceal the presence or activity of software through modifications to system visibility or privileged inspection mechanisms. The developer's planted code instead waits for an employment-account status change before deleting files. That is a conditional destructive trigger, with no stated hiding of kernel modules, hooks, or processes. Rootkit techniques might be used to conceal a logic bomb, but concealment is not the defining behavior here.

Ransomware typically denies access to data or systems to force victims into paying a ransom or making a concession. The malicious code deletes files after an employment account is disabled, but the case does not mention encryption, a payment demand, or any extortion objective. File destruction can cause serious outages without being ransomware. The special evidence is the trigger tied to an employment event, which points to a logic bomb rather than a monetized availability attack.

Keylogging malware captures keyboard input, usually to steal typed secrets or monitor user activity. The implanted code is described as deleting files after the developer's account becomes disabled; it does not record keystrokes or export credentials. An attacker could install both mechanisms, but nothing here connects the payload to keyboard interception. The required inference is the code's deferred execution condition, not a surveillance or credential-theft function.

Keylogging malware intercepts keyboard events and may record passwords or other typed information. The kernel module in this case hides processes and network sockets from inspection but is not reported to capture input. Both keyloggers and rootkits can operate with elevated privileges, yet their characteristic behavior differs. Classifying the module as a keylogger would infer a credential collection capability rather than address its verified suppression of system visibility.

Spyware collects information such as browsing history, messages, screenshots, or user activity and transmits it without authorization. This module's described function is concealment of its process and network sockets, not collection or exfiltration of personal information. A rootkit might protect spyware from detection, but the presence of stealth alone does not prove the payload's surveillance goal. The supported classification should follow the module's observed hiding behavior.

A file-dependent virus replicates by inserting copies of malicious code into host files that later execute it. The kernel module is said to hide processes and network connections, with no file infection, replication, or user-opened host document. A virus might use rootkit capabilities to evade detection, but replication must be evidenced before assigning the virus label. The case instead provides a specific rootkit-style concealment action.

A Trojan generally masquerades as legitimate software or conceals a malicious function in an apparently useful application, but it does not have to reproduce by infecting files. This case explicitly says the macro code attaches copies of itself to other local documents and runs again when a newly infected file is opened. That replication through host documents makes a virus more specific than a mere disguised installer. Trojan packaging alone would not explain the repeated infection of additional documents.

A self-propagating network worm can seek and exploit reachable hosts without a person opening an infected document each time. The scenario explicitly rules out autonomous network scanning and says copied malicious code spreads to other documents, with execution triggered when those files are opened. That host-file dependency distinguishes the described virus from a network worm. An adversary could distribute infected documents broadly, but the stated replication mechanism still depends on file infection rather than independent host exploitation.

A logic bomb activates a malicious payload after a specific condition, such as a date, a role removal, or a system event. The code here runs when an infected document is opened and actively replicates by infecting other documents; no delayed condition beyond normal file execution is introduced. A virus could incorporate a logic-bomb trigger, but the observable behavior to classify is host-file replication. Treating routine document opening as a logic bomb would obscure the actual propagation mechanism.

On-path modification occurs when an adversary intercepts and alters communications between endpoints, potentially changing requests or responses in transit. The scenario instead describes many sources simultaneously overwhelming a service's ingress capacity. No intermediary gateway, changed payload, or modified message is reported. Both can disrupt service, but the decisive observation is the distributed traffic volume, not a tampered conversation. Treating a network flood as on-path manipulation would misdirect the incident investigation.

Reflected DNS amplification is one specific form of DDoS in which attackers spoof a victim's source address in DNS queries to amplifying reflectors that send larger responses to that victim. The stem reports thousands of sources flooding ingress capacity but says nothing about DNS, spoofed queries, or amplified responses. DNS amplification could cause these symptoms, but selecting it would infer an unobserved mechanism. The broader category of distributed denial of service is supported by the evidence.

DNS cache poisoning supplies false address records to a resolver so users are misdirected when resolving legitimate names. The question describes traffic saturation from many sources, not forged DNS records or users receiving a malicious address for a hostname. A compromised DNS infrastructure could contribute to other attacks, but that is not evidenced here. The observed availability failure comes from excessive distributed traffic rather than corrupted name-resolution data.

DNS cache poisoning changes the resolver's stored answer for a name so future clients receive incorrect addresses. The victim in this scenario is receiving large DNS responses from many reflectors after forged queries, not resolving a legitimate bank hostname to a malicious IP. The forged source address is used to redirect reply traffic and amplify load, not to insert a false cached record. The relevant problem is reflective traffic generation rather than answer integrity.

Distributed denial of service is the broader effect of many sources generating enough traffic or requests to disrupt availability. Reflected DNS amplification fits within this category, which makes DDoS a related but less precise alternative. The question supplies a distinctive mechanism: oversized DNS responses induced by spoofed queries and sent from multiple reflectors. A more technically useful identification names reflection and amplification, not only the service outage that may result.

DNS tunneling can conceal data inside repeated or unusually structured DNS queries and responses, allowing an infected host to exchange information through name resolution. This victim sees oversized replies from reflectors after spoofed-source queries, a volumetric pattern rather than evidence of encoded data exchange. Long base-encoded subdomain labels, repeated periodic requests, and external query anomalies would be more relevant to tunneling. The supplied evidence instead supports amplification directed at a victim address.

On-path modification changes communications while they travel between endpoints, often by a malicious intermediary manipulating application messages. Users here reach the wrong destination because a DNS resolver provides forged name-to-address data. No gateway is shown editing live HTTP requests or TLS sessions after resolution. An attacker might perform an on-path attack to inject DNS responses, but the observed security outcome is poisoned resolver state and corrupted address answers, which is more specific.

Reflected DNS amplification uses spoofed queries and many DNS reflectors to send inflated reply traffic toward a victim, normally to exhaust capacity. This case describes legitimate name lookups producing an attacker-controlled IP due to forged resolver data, not an incoming flood of oversized DNS packets. The primary harm is integrity of name resolution and potential phishing redirection, not availability lost through traffic amplification. The presence of DNS in both attacks does not make them equivalent.

DNS tunneling usually embeds command-and-control or exfiltrated data in DNS label contents or unusual query patterns. The symptom here is a wrong address returned for a legitimate banking name due to forged DNS records. No encoded labels, repeated long queries, or data exchange using DNS are described. Poisoning manipulates where name resolution points, whereas tunneling uses DNS traffic as a covert communication carrier. The observed symptom matches poisoning rather than tunneling.

A protocol downgrade attack coerces endpoints into using an older or weaker protocol or cipher than they otherwise could negotiate. The rogue gateway here intercepts and modifies HTTP requests, but the question does not say any transport negotiation or encryption version was forced down. A downgrade can be performed by an on-path attacker, yet it is a narrower behavior that needs specific negotiation evidence. The demonstrated activity is interception and alteration of application traffic.

DNS cache poisoning changes the IP address a resolver returns for a hostname, potentially sending users to an attacker-controlled endpoint. This case specifies a rogue gateway that directly intercepts and changes HTTP requests between a user and internal application. No DNS record or name-resolution answer has been manipulated. Both might facilitate redirection, but the relevant security boundary here is in-transit request integrity at the gateway rather than the resolver cache.

Credential replay reuses captured passwords, tokens, or session artifacts to authenticate without obtaining the legitimate user's secret again. The rogue gateway is observed changing HTTP requests while they travel between endpoints, not presenting a stolen session token to impersonate a user. A gateway could potentially steal credentials, but the question does not say that happened. Selecting replay would invent a later authentication step and miss the actual tampering technique.