CEH Practice Question: Malware, Social Engineering and Network Attacks
A security analyst notices that an internal server is sending a high volume of DNS queries to external servers for non-existent domains. Which type of malware behavior is MOST likely being observed?
⚠ Common exam trap
CEH often tests the misconception that high DNS query volume for non-existent domains is always data exfiltration (spyware), but the key differentiator is the random, high-frequency pattern typical of DGA-based worms, not the structured, low-frequency pattern of exfiltration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A worm spreading across the network
A high volume of DNS queries to external servers for non-existent domains is a classic indicator of a worm using DNS as a covert channel for command-and-control (C2) communication or propagation. Worms often generate random domain names (e.g., Domain Generation Algorithm, DGA) to evade static blocklists, and the high query rate reflects attempts to resolve these domains to locate a C2 server or to spread to new hosts via DNS-based discovery.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Spyware exfiltrating data
Why it's wrong here
Spyware is designed to covertly collect sensitive information from a victim's system, such as browsing history or credentials, and exfiltrate it to a remote server. While this process generates network traffic, the observed high-volume DNS queries to non-existent domains are not typical for data exfiltration. This pattern more strongly suggests an active scanning or propagation attempt rather than the stealthy transmission of collected data.
- ✗
A keylogger capturing keystrokes
Why it's wrong here
A keylogger's primary function is to record user keystrokes and other input events, storing them locally before periodically transmitting the collected logs to a command-and-control server. This exfiltration typically involves intermittent, targeted communication, not a sustained barrage of DNS queries. Therefore, high-volume DNS requests for non-existent domains are inconsistent with the operational signature of a keylogger primarily focused on data collection and periodic upload.
- ✓
A worm spreading across the network
Why this is correct
Worms are self-propagating malware that actively seek out and infect new hosts across a network without user interaction. Their propagation mechanisms frequently involve scanning IP ranges or performing numerous DNS lookups to discover vulnerable machines or services. High-volume DNS queries, especially for non-existent domains, are a classic indicator of a worm actively attempting to resolve hostnames or discover new targets during its infection cycle.
- ✗
Ransomware encrypting files
Why it's wrong here
Ransomware's core functionality revolves around encrypting a victim's files and demanding a ransom for their decryption, primarily operating as a local file system manipulation. While initial infection or key exchange might involve some network communication, the active encryption phase does not typically generate high-volume DNS queries. This observed network behavior is not characteristic of ransomware's primary objective or operational footprint during its destructive phase.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.