CEH Practice Question: Malware, Social Engineering and Network Attacks
A security analyst reviews a sandbox report for a suspicious executable. The report shows that the executable modified the Windows registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to add a new entry pointing to itself. This action is characteristic of which type of malware?
⚠ Common exam trap
The trap here is that candidates might associate any registry modification with ransomware or adware, but the specific action of adding itself to the Run key for persistence is most characteristic of a backdoor Trojan, not the other options.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Backdoor Trojan
The registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run is a standard autostart location used by Windows to launch programs at system boot. A backdoor Trojan commonly adds itself to this key to achieve persistence, ensuring it runs every time the system starts, which allows an attacker to maintain remote access. This behavior is a hallmark of backdoor Trojans, not other malware types.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Logic bomb
Why it's wrong here
A logic bomb triggers under predefined conditions, not by adding startup entries.
- ✓
Backdoor Trojan
Why this is correct
Backdoor Trojans commonly use registry run keys for persistence.
- ✗
Ransomware
Why it's wrong here
Ransomware encrypts files and demands payment, but may also use startup persistence.
- ✗
Adware
Why it's wrong here
Adware displays advertisements but doesn't typically add itself to startup.
Go deeper
Related to this question
About these practice questions
One of 913 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.