Problem Statement
What is a rootkit and how can operating system design help defend against it?
Explanation
A rootkit is a stealthy type of malicious software that embeds itself deep inside the operating system — often at kernel level — to gain elevated privileges, hide itself, intercept system calls or manipulate kernel data structures. Defending against rootkits requires OS features like integrity checking of kernel code and data, secure boot to verify initial code, memory protection (e.g., W^X), mandatory access control, module signing and monitoring suspicious behaviour. Also, isolating kernel modules and reducing trusted code (trusted computing base) limits the risk. Explaining how OS architecture helps mitigate rootkits shows strong interview understanding.
