Courseiva

CCNA Cryptography and Malware Analysis Questions

15 questions · Cryptography and Malware Analysis · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQhard

A security engineer needs to configure a web server to support Perfect Forward Secrecy (PFS) for HTTPS connections. Which of the following key exchange methods should be prioritized?

A.Diffie-Hellman (DH) key exchange
B.Elliptic Curve Diffie-Hellman Ephemeral (ECDHE)
C.Pre-Shared Key (PSK)
D.RSA key exchange
AnswerB

Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) is the correct choice because it provides Perfect Forward Secrecy (PFS) by generating unique, ephemeral session keys for each TLS handshake. This means that even if the server's long-term private key is compromised in the future, an attacker cannot decrypt previously recorded sessions. The ephemeral keys are derived using elliptic curve cryptography, offering strong security with smaller key sizes and faster computations compared to traditional Diffie-Hellman, making it ideal for web servers.

Why this answer

ECDHE is prioritized for Perfect Forward Secrecy because it generates a unique, ephemeral session key for each TLS handshake using elliptic curve cryptography, ensuring that if the server's long-term private key is compromised, past session keys remain secure. Unlike static Diffie-Hellman, ECDHE does not reuse key material, and it offers stronger security per bit compared to traditional DH, making it the recommended choice for PFS in modern HTTPS configurations.

Exam trap

EC-Council often tests the misconception that any Diffie-Hellman variant automatically provides PFS, but candidates must remember that only ephemeral modes (DHE or ECDHE) guarantee forward secrecy, while static DH does not.

How to eliminate wrong answers

Option A is wrong because standard Diffie-Hellman (DH) key exchange can be used in ephemeral mode (DHE) to provide PFS, but the question asks for the method to be 'prioritized'; ECDHE is preferred over DH due to its smaller key sizes, faster computation, and equivalent security strength, so DH is not the top priority. Option C is wrong because Pre-Shared Key (PSK) is a symmetric key method that does not provide forward secrecy—if the PSK is compromised, all past sessions using that key are exposed. Option D is wrong because RSA key exchange is static; the client encrypts the pre-master secret with the server's RSA public key, so if the server's private key is later compromised, all recorded sessions can be decrypted, violating PFS.

Practice this question →
2
MCQeasy

During a penetration test, a security analyst discovers that an organization's web application uses HTTP for login forms, potentially exposing credentials to interception. Which of the following is the BEST cryptographic control to implement to protect credentials in transit?

A.Implement password hashing with bcrypt on the server side.
B.Use digital signatures to sign the login request.
C.Enforce HTTPS using TLS 1.2 or higher.
D.Encrypt the password field using AES-256 before sending via HTTP.
AnswerC

Enforcing HTTPS using TLS 1.2 or higher is the most effective solution for protecting credentials during transmission. TLS establishes an encrypted tunnel between the client and the server, ensuring confidentiality, integrity, and authenticity for all data exchanged, including login credentials. This robust encryption prevents eavesdropping, tampering, and man-in-the-middle attacks by encrypting the entire communication channel end-to-end.

Why this answer

HTTPS with TLS 1.2 or higher encrypts the entire HTTP session, including login credentials, preventing interception and man-in-the-middle attacks. This is the standard cryptographic control for protecting data in transit, as mandated by RFC 2818 and PCI DSS. TLS 1.2+ uses strong cipher suites like ECDHE-RSA-AES256-GCM-SHA384 to ensure forward secrecy and confidentiality.

Exam trap

The trap here is that candidates confuse encryption at rest (hashing) or partial encryption (AES on password field) with full-session encryption (TLS), or they think digital signatures provide confidentiality, when in fact they only ensure authenticity and integrity.

How to eliminate wrong answers

Option A is wrong because password hashing with bcrypt protects credentials at rest on the server, not during transit over the network. Option B is wrong because digital signatures provide integrity and non-repudiation but do not encrypt the login request, leaving the credentials visible to an interceptor. Option D is wrong because encrypting only the password field with AES-256 before sending over HTTP still leaves the rest of the request (e.g., session tokens, form data) in plaintext, and the encryption key must be shared insecurely, defeating the purpose.

Practice this question →
3
MCQmedium

You are a security analyst for a medium-sized company. The company uses a custom web application for internal project management. The application uses AES-256-CBC for encrypting sensitive data stored in the database. Recently, the company experienced a data breach where an attacker exfiltrated the entire database. Although the data was encrypted, the attacker was able to decrypt some records. Investigation reveals that the encryption key is stored in a configuration file on the same server, and the initialization vector (IV) is hardcoded in the application code. Additionally, the application uses the same key for all records. Which of the following is the most effective remediation to prevent future decryption of stolen encrypted data?

A.Change the encryption mode from CBC to GCM to provide authentication
B.Store the encryption key in a hardware security module (HSM) and use the same key
C.Rotate the encryption key every 24 hours
D.Implement per-record encryption keys derived from a master key combined with a unique salt
AnswerD

Implementing per-record encryption keys derived from a master key combined with a unique salt is the most robust solution. This method ensures that each individual record is encrypted with a distinct, cryptographically unique key generated using a Key Derivation Function (KDF). Consequently, if one derived record key is ever compromised, only that specific record is affected, leaving all other records protected by their respective unique keys and the secure master key. This significantly limits the impact of any single key compromise, enhancing overall data security.

Why this answer

Using per-record encryption keys derived from a master key combined with a unique salt ensures that even if an attacker exfiltrates the entire database, each encrypted record requires a separate key derivation operation. Without the unique salt per record, the attacker cannot decrypt all records even if they compromise the master key. This approach mitigates the risk of a single key compromise leading to bulk decryption, which is the core vulnerability in the current setup where the same AES-256-CBC key and hardcoded IV are reused across all records.

Exam trap

The trap here is that candidates often focus on key storage or rotation (options B and C) as the primary solution, overlooking that the real vulnerability is the reuse of a single key across all records, which allows an attacker to decrypt the entire dataset with a single key compromise.

How to eliminate wrong answers

Option A is wrong because changing the encryption mode from CBC to GCM adds authentication (integrity) but does not address the fundamental issue of a single static key and IV being reused; an attacker who steals the database and the key can still decrypt all records regardless of the mode. Option B is wrong because storing the encryption key in an HSM while still using the same key for all records does not prevent an attacker from decrypting all stolen data if they compromise the application at runtime or obtain the key from the HSM via authorized access; the HSM protects the key at rest but does not mitigate the single-key reuse vulnerability. Option C is wrong because rotating the encryption key every 24 hours only limits the window of exposure for future records; it does not protect already exfiltrated encrypted data that was encrypted with the old key, and the attacker can still decrypt all records encrypted before the rotation if they have the old key.

Practice this question →
4
MCQeasy

A security analyst receives an alert about a suspicious file hash. The analyst wants to check if the file is known malware by querying an online database of malware signatures. Which tool should the analyst use?

A.Nmap
B.John the Ripper
C.VirusTotal
D.Wireshark
AnswerC

VirusTotal is a web-based service that aggregates many antivirus products and online scan engines to check for viruses and other types of malicious content. A security analyst can submit a file's cryptographic hash (e.g., MD5, SHA1, SHA256) to VirusTotal, which then queries its extensive database and provides immediate detection results from numerous security vendors. This capability directly addresses the need to determine if a suspicious file is known malware by comparing its hash against a vast repository of threat intelligence.

Why this answer

VirusTotal is a free online service that aggregates multiple antivirus engines and malware detection tools, allowing users to upload files or query file hashes against a vast database of known malware signatures. This directly matches the requirement to check if a file is known malware by querying an online database.

Exam trap

The trap here is that candidates may confuse tools like Nmap or Wireshark for malware analysis because they are commonly used in security investigations, but they lack the specific function of querying an online malware signature database.

How to eliminate wrong answers

Option A is wrong because Nmap is a network scanning tool used for discovering hosts and services on a network, not for querying malware signature databases. Option B is wrong because John the Ripper is a password cracking tool that performs brute-force or dictionary attacks on password hashes, not a malware signature lookup service. Option D is wrong because Wireshark is a network protocol analyzer used for capturing and inspecting network traffic packets, not for checking file hashes against malware databases.

Practice this question →
5
MCQmedium

An ethical hacker is analyzing a piece of malware that uses a custom encryption algorithm. The malware sample contains a hardcoded key that is 16 bytes long. The analyst observes that the encrypted data is the same length as the plaintext. Which encryption mode is most likely being used?

A.GCM
B.CFB
C.ECB
D.CBC
AnswerC

Electronic Codebook (ECB) mode encrypts each fixed-size block of plaintext independently using the same secret key. It does not employ any chaining mechanism between blocks, nor does it require an Initialization Vector (IV) or nonce. The only potential increase in data length results from padding the final plaintext block to meet the cipher's block size, making it the mode that introduces the absolute minimum cryptographic overhead and data expansion.

Why this answer

ECB (Electronic Codebook) mode encrypts each block of plaintext independently using the same key, so the ciphertext length equals the plaintext length (assuming no padding is needed for exact block sizes). The hardcoded 16-byte key and identical input/output lengths strongly suggest ECB, as other modes typically add an IV or authentication tag, altering the output length.

Exam trap

The trap here is that candidates often forget that ECB does not use an IV or authentication tag, so they incorrectly assume all block cipher modes add overhead, leading them to choose CBC or GCM despite the length constraint.

How to eliminate wrong answers

Option A (GCM) is wrong because GCM produces an authentication tag (usually 16 bytes) in addition to ciphertext, making the output longer than the plaintext. Option B (CFB) is wrong because CFB is a stream cipher mode that requires an IV (initialization vector), which would add extra bytes to the output or be transmitted separately, contradicting the identical length observation. Option D (CBC) is wrong because CBC requires an IV (typically 16 bytes for AES) that must be included with the ciphertext, increasing the total output length beyond the plaintext length.

Practice this question →
6
MCQhard

During a forensic investigation, an analyst finds that a malware sample uses a technique to detect if it is running in a sandbox by checking the number of CPU cores. The malware terminates execution if the core count is less than 2. Which anti-analysis technique is this?

A.Code obfuscation
B.Anti-debugging
C.Anti-VM / sandbox evasion
D.Packing
AnswerC

Anti-VM and sandbox evasion techniques are employed by malware to determine if it is executing within a virtualized environment or an automated analysis sandbox, which often have deliberately limited resources. Checking for low CPU core counts, minimal RAM, small disk sizes, or generic hardware identifiers are common heuristics used by malware to detect these environments. If such conditions are met, the malware may alter its behavior, remain dormant, or self-terminate to avoid detection and analysis, thus preserving its efficacy.

Why this answer

Checking the number of CPU cores is a classic anti-VM/sandbox evasion technique. Virtual machines and sandboxes often allocate minimal resources (e.g., a single core) to remain lightweight, so malware uses this check to detect an analysis environment and terminate execution to avoid detection.

Exam trap

EC-Council often tests the distinction between anti-debugging and anti-VM techniques; the trap here is that candidates confuse resource-based checks (like CPU cores) with debugger detection, but anti-debugging specifically targets debugger artifacts, not hardware resource enumeration.

How to eliminate wrong answers

Option A is wrong because code obfuscation involves transforming code to make it harder to read or reverse-engineer (e.g., using junk code or control flow flattening), not checking hardware resources like CPU cores. Option B is wrong because anti-debugging techniques target debuggers (e.g., checking for IsDebuggerPresent or NtGlobalFlag), not the number of CPU cores. Option D is wrong because packing compresses or encrypts the executable to hide its original code, but does not involve runtime checks of system resources.

Practice this question →
7
MCQeasy

A security analyst suspects that a user's machine is infected with a keylogger. Which of the following is the most effective method to detect a hardware keylogger?

A.Check running processes for suspicious entries
B.Physically inspect the connection between the keyboard and the computer
C.Review USB device history in Event Viewer
D.Run an antivirus scan
AnswerB

Hardware keyloggers are physical devices designed to be inconspicuous, often resembling a standard cable adapter or a small inline dongle. They are typically inserted directly between the keyboard's cable and the computer's keyboard port (e.g., USB or PS/2). A direct physical examination of this connection point is the most reliable and often the only method to visually identify and remove such a device, as it bypasses all software-based detection limitations.

Why this answer

A hardware keylogger is a physical device inserted between the keyboard and the computer, typically at the PS/2 or USB connector. Unlike software-based keyloggers, it operates independently of the operating system, so it cannot be detected by process lists, event logs, or antivirus scans. The only reliable detection method is a physical inspection of the keyboard cable and connection point for any unusual inline devices.

Exam trap

The trap here is that candidates assume all keyloggers are software-based and can be detected by OS-level tools, but CEH specifically tests the distinction between hardware and software keyloggers, where physical inspection is the only definitive method for hardware variants.

How to eliminate wrong answers

Option A is wrong because checking running processes detects software keyloggers, not hardware keyloggers, which have no process or driver footprint in the OS. Option C is wrong because reviewing USB device history in Event Viewer may show connected devices but cannot identify a passive inline hardware keylogger that does not register as a new USB device. Option D is wrong because an antivirus scan relies on signature or behavioral analysis of executable code, and a hardware keylogger has no software component to scan.

Practice this question →
8
MCQmedium

A company wants to secure its email communications using digital signatures. Which cryptographic key does the sender use to sign the email?

A.Sender's public key
B.Sender's private key
C.Recipient's private key
D.Recipient's public key
AnswerB

The sender's private key is the correct cryptographic component used to create a digital signature. This unique, secret key is applied to a hash of the email content, producing a signature that proves the sender's identity and ensures message integrity. Only the legitimate sender possesses this key, thereby providing non-repudiation and guaranteeing authenticity to the recipient.

Why this answer

Digital signatures use asymmetric cryptography where the sender signs the email with their private key. The recipient then verifies the signature using the sender's public key, ensuring authenticity and non-repudiation. This is defined in standards like S/MIME (RFC 5751) and OpenPGP (RFC 4880).

Exam trap

The trap here is that candidates confuse the roles of keys in encryption vs. signing, often selecting the sender's public key because they associate 'public' with sharing, but signing requires the private key to prove the sender's identity.

How to eliminate wrong answers

Option A is wrong because the sender's public key is used for verification by the recipient, not for signing; signing requires the private key to create a unique digital signature. Option C is wrong because the recipient's private key is used for decrypting messages encrypted with their public key, not for signing the sender's email. Option D is wrong because the recipient's public key is used for encrypting messages to the recipient, not for signing the sender's email.

Practice this question →
9
MCQhard

You are a security analyst at a financial institution. The SOC has detected anomalous outbound traffic from a server in the DMZ to an unknown IP address on TCP port 8443. The server runs a custom application that normally communicates with internal databases on port 1433. The server's OS is Windows Server 2019. Preliminary analysis shows that a new service named 'UpdateSvc' was installed three days ago, set to start automatically, and runs under the LocalSystem account. The service binary is located at C:\Windows\System32\svchost.exe (the legitimate one). However, the service's 'ImagePath' registry key points to 'C:\Windows\System32\svchost.exe -k UpdateSvc'. Additionally, a scheduled task named 'HealthCheck' runs every hour and executes 'powershell.exe -EncodedCommand <base64>'. The encoded command decodes to a script that downloads a payload from the same unknown IP on port 8443 and executes it in memory. The server has antivirus installed that detected nothing. As the analyst, which of the following is the BEST immediate course of action?

A.Reimage the server immediately to ensure the malware is completely removed.
B.Uninstall the current antivirus and install a different endpoint protection solution, then perform a full scan.
C.Delete the 'UpdateSvc' service and the 'HealthCheck' scheduled task, then run a full antivirus scan.
D.Isolate the server from the network by disconnecting the network cable and blocking the IP at the firewall, then initiate incident response procedures.
AnswerD

Isolating the compromised server is the critical first step in containing an active security incident. Disconnecting the network cable physically severs all external and internal network communication, immediately halting data exfiltration, command-and-control (C2) communications, and preventing lateral movement to other systems. Blocking the IP at the firewall provides an additional layer of network-level containment. This action preserves the system's state for forensic analysis while stopping the immediate threat, allowing for a structured incident response process to follow.

Why this answer

The immediate priority is to contain the threat by isolating the compromised server from the network (disconnecting the cable) and blocking the command-and-control IP at the firewall. This stops the ongoing outbound communication on TCP port 8443 and prevents further payload downloads or data exfiltration. Initiating incident response procedures ensures proper forensic collection and analysis, which is critical before any remediation steps like reimaging or deleting artifacts.

Exam trap

The trap here is that candidates focus on removing the malware artifacts (service and task) rather than containing the threat first, which is a fundamental incident response principle: isolate before eradicate.

How to eliminate wrong answers

Option A is wrong because reimaging the server immediately destroys volatile evidence (e.g., memory, running processes, network connections) that is essential for understanding the attack vector and scope. Option B is wrong because changing antivirus software mid-incident wastes time and does not address the active compromise; the malware is already evading detection via fileless execution (PowerShell in memory), so a scan is unlikely to find it. Option C is wrong because deleting the service and scheduled task without first isolating the server allows the attacker to reinstall them or escalate privileges, and the malware may have persistence mechanisms beyond these two artifacts.

Practice this question →
10
Matchingmedium

Match each vulnerability assessment tool to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Automated vulnerability scanning

Open-source vulnerability scanner

Cloud-based vulnerability management

Network vulnerability scanner

Web server vulnerability scanner

Why these pairings

Correct matches: Nmap for network scanning, Nessus for vulnerability assessment, Metasploit for exploitation. Common confusions involve swapping scanning and vulnerability roles.

Practice this question →
11
MCQmedium

Refer to the exhibit. An analyst suspects that the downloaded file 'update.exe' may have been tampered with. The vendor's official website lists the SHA256 hash as 4e7c2a8f9b3d1e5f6a0c8b7d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f. What should the analyst conclude?

A.The file has been tampered with because the hash is from a different file.
B.The SHA256 hash is not reliable; the analyst should use MD5 instead.
C.The file is authentic and has not been tampered with.
D.The file is malicious because the hash is too long.
AnswerC

This statement is correct. When the cryptographic hash (e.g., SHA256) calculated from a downloaded file precisely matches the official, published hash value, it provides strong cryptographic assurance. This match confirms that the file's contents are identical to the original source and have not been altered, corrupted, or tampered with during transit or storage, thereby establishing its authenticity and integrity.

Why this answer

The SHA256 hash provided by the vendor exactly matches the hash of the downloaded file. SHA256 is a cryptographically strong hash function that produces a fixed 256-bit (64-character hexadecimal) output. A matching hash confirms the file's integrity and authenticity, indicating it has not been tampered with.

Exam trap

The trap here is that candidates may mistakenly think a hash that matches is suspicious or that SHA256 is unreliable, when in fact a matching hash is the definitive proof of file integrity; the exam tests whether you understand that hash length and format are fixed and correct for SHA256.

How to eliminate wrong answers

Option A is wrong because the hash matches the vendor's official hash, so it is not from a different file; a mismatch would indicate tampering. Option B is wrong because SHA256 is more secure and collision-resistant than MD5; MD5 is deprecated due to known vulnerabilities and should not be used for integrity verification. Option D is wrong because the hash length (64 hex characters) is exactly correct for SHA256; a 256-bit hash is always 64 characters in hexadecimal representation, so it is not 'too long'.

Practice this question →
12
MCQhard

A company's internal PKI uses an offline root CA and an online issuing CA. A security engineer needs to revoke a compromised certificate issued by the online CA. Which CRL distribution point should the engineer update?

A.The CRL published by the certificate authority that signed the issuing CA's certificate
B.The CRL published by the intermediate CA, if any
C.The CRL published by the online issuing CA
D.The CRL published by the offline root CA
AnswerC

The online issuing CA is directly responsible for generating, signing, and managing the lifecycle of end-entity certificates within this PKI. When an end-entity certificate needs to be revoked, it is the issuing CA that records this revocation event and publishes it in its own Certificate Revocation List (CRL). Consequently, clients validating an end-entity certificate must consult the CRL published by the online issuing CA to ascertain its current revocation status.

Why this answer

The compromised certificate was issued by the online issuing CA, so only that CA has the authority to revoke it and publish the updated CRL. Clients validating the certificate will check the CRL distribution point (CDP) embedded in the certificate, which points to the issuing CA's CRL. Updating the CRL on the online issuing CA ensures that revocation status is immediately available to relying parties.

Exam trap

EC-Council often tests the misconception that the root CA must be involved in revocation of end-entity certificates, but in reality only the issuing CA that signed the certificate can revoke it and update its own CRL.

How to eliminate wrong answers

Option A is wrong because the CRL published by the CA that signed the issuing CA's certificate (the offline root CA) contains only revocation information for the issuing CA's certificate itself, not for end-entity certificates issued by the online CA. Option B is wrong because in this two-tier hierarchy there is no intermediate CA; even if one existed, the intermediate CA's CRL would cover certificates it issued, not those issued by the online issuing CA. Option D is wrong because the offline root CA is typically kept offline and does not publish a CRL for end-entity certificates; its CRL (if any) only covers subordinate CA certificates, not user or device certificates.

Practice this question →
13
Multi-Selecthard

An organization is investigating a potential malware infection. The security analyst observes unusual outbound connections to a known malicious IP address and finds a suspicious process running under a user's session. The analyst decides to perform memory analysis using Volatility. Which TWO commands would be most useful to identify the malicious process and its network connections?

Select 2 answers
A.volatility -f memory.dmp netscan
B.volatility -f memory.dmp pslist
C.volatility -f memory.dmp procdump
D.volatility -f memory.dmp svcscan
E.volatility -f memory.dmp malfind
AnswersA, B

The `volatility -f memory.dmp netscan` command is crucial for initial malware investigation because it enumerates all active network connections present in the memory dump. This allows incident responders to quickly identify suspicious outbound connections to unknown or malicious IP addresses, which are strong indicators of command and control (C2) communication, data exfiltration, or botnet activity. Confirming such network activity is a primary step in validating a potential infection.

Why this answer

The `netscan` plugin in Volatility scans the memory dump for network connections and sockets, including TCP and UDP endpoints, which directly reveals outbound connections to the malicious IP. The `pslist` plugin lists all running processes by walking the process list in the kernel, allowing the analyst to identify the suspicious process by name or PID. Together, these two commands provide the process identity and its network activity, which is exactly what the scenario requires.

Exam trap

The trap here is that candidates may choose `malfind` (option E) because it sounds malware-specific, but it does not list all processes or network connections, whereas `pslist` and `netscan` directly answer the question of identifying the process and its outbound connections.

Practice this question →
14
MCQmedium

During a penetration test, an ethical hacker finds that a web application transmits sensitive data in plaintext over HTTPS. Which of the following best describes this security issue?

A.Weak TLS cipher suite
B.Lack of application-layer encryption
C.SSL stripping attack
D.Man-in-the-middle attack
AnswerB

This is the correct answer because while HTTPS encrypts data in transit between the client and server, it does not inherently encrypt data at the application layer before it is sent or when it is stored. If sensitive fields are not encrypted by the application itself, they could be exposed in memory, logs, or databases on the server side, even if the network communication is secure. The application's failure to encrypt sensitive data before processing or storage creates a vulnerability independent of transport security.

Why this answer

The core issue is that the web application transmits sensitive data in plaintext over HTTPS, meaning the data is encrypted in transit by TLS but not encrypted at the application layer. This leaves the data vulnerable to exposure if the TLS termination point (e.g., a reverse proxy or load balancer) is compromised or if logs capture the plaintext payload. Application-layer encryption (e.g., encrypting the data before sending it over HTTPS) ensures end-to-end confidentiality, even if the TLS channel is broken or inspected.

Exam trap

The trap here is that candidates confuse 'encrypted in transit' (TLS) with 'encrypted at the application layer,' assuming HTTPS alone provides end-to-end data confidentiality, but the CEH exam tests the distinction between transport-layer and application-layer encryption.

How to eliminate wrong answers

Option A is wrong because a weak TLS cipher suite refers to the use of outdated or insecure cryptographic algorithms (e.g., RC4, DES) for the TLS handshake, which is not the issue here—the data is transmitted over HTTPS with presumably strong TLS, but the application itself does not encrypt the payload. Option C is wrong because an SSL stripping attack is a man-in-the-middle technique that downgrades HTTPS to HTTP, which is not described in the scenario; the question states the data is transmitted over HTTPS, not that the protocol is downgraded. Option D is wrong because a man-in-the-middle attack is an active interception technique (e.g., ARP spoofing, rogue access point) that could capture plaintext data, but the security issue described is the lack of application-layer encryption, not the presence of an active attack.

Practice this question →
15
Multi-Selecteasy

Which TWO of the following are characteristics of a polymorphic virus? (Choose two.)

Select 2 answers
A.Remains constant in code to ensure replication
B.Mutates its code to evade signature detection
C.Uses encryption with a variable key
D.Spreads via network shares
E.Resides in the boot sector of a hard drive
AnswersB, C

Polymorphic viruses are specifically designed with a mutation engine that generates a different, functionally identical variant of the virus body with each replication. This constant alteration of their code signature, including instruction sequences and encryption routines, makes it extremely challenging for traditional signature-based antivirus software to identify and block them. The primary goal of this mutation is to bypass detection mechanisms that rely on fixed patterns.

Why this answer

A polymorphic virus mutates its code—typically by using a mutation engine—while preserving its original functionality. This mutation changes the virus's signature each time it replicates, allowing it to evade signature-based detection by antivirus software. Option C is correct because polymorphic viruses commonly use encryption with a variable key; the virus body is encrypted, and the decryption routine mutates, so the encrypted payload looks different with each infection.

Exam trap

The trap here is that candidates often confuse 'polymorphic' with 'metamorphic' or assume that all viruses that use encryption are polymorphic, but the key distinction is that polymorphic viruses use a variable key and mutate the decryption routine, whereas simple encrypted viruses use a fixed key and do not change their decryptor.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Cryptography and Malware Analysis questions.

Start 20-question session