CEH Cryptography and Malware Analysis Practice Question
A security analyst suspects that a user's machine is infected with a keylogger. Which of the following is the most effective method to detect a hardware keylogger?
⚠ Common exam trap
A common mix-up: candidates assume all keyloggers are software-based and can be detected by OS-level tools, but CEH specifically tests the distinction between hardware and software keyloggers, where physical inspection is the only definitive method for hardware variants.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Physically inspect the connection between the keyboard and the computer
A hardware keylogger is a physical device inserted between the keyboard and the computer, typically at the PS/2 or USB connector. Unlike software-based keyloggers, it operates independently of the operating system, so it cannot be detected by process lists, event logs, or antivirus scans. The only reliable detection method is a physical inspection of the keyboard cable and connection point for any unusual inline devices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Check running processes for suspicious entries
Why it's wrong here
Hardware keyloggers operate at a physical layer, intercepting keystrokes between the keyboard and the computer's input port before they are processed by the operating system. Consequently, these devices do not execute as software processes within the operating system's memory space. Checking running processes would only reveal software-based malware or legitimate applications, rendering this method entirely ineffective for detecting a physical keylogger.
- ✓
Physically inspect the connection between the keyboard and the computer
Why this is correct
Hardware keyloggers are physical devices designed to be inconspicuous, often resembling a standard cable adapter or a small inline dongle. They are typically inserted directly between the keyboard's cable and the computer's keyboard port (e.g., USB or PS/2). A direct physical examination of this connection point is the most reliable and often the only method to visually identify and remove such a device, as it bypasses all software-based detection limitations.
- ✗
Review USB device history in Event Viewer
Why it's wrong here
While Event Viewer can log the connection of new USB devices, many sophisticated hardware keyloggers are designed to operate transparently, often mimicking the original keyboard's device ID or functioning as a pass-through device. This stealth capability means they may not generate distinct, suspicious entries in the USB device history that would clearly indicate a malicious device. Therefore, relying solely on Event Viewer logs is insufficient for definitive detection.
- ✗
Run an antivirus scan
Why it's wrong here
Antivirus software is specifically engineered to detect, quarantine, and remove malicious software components, such as viruses, worms, and software-based keyloggers, by scanning files and monitoring system behavior. Hardware keyloggers, however, are standalone physical devices that do not install files on the system or execute code within the operating system. An antivirus scan would therefore completely overlook such a device, as it operates outside the scope of software-level detection.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.