Polymorphic Virus: Key Characteristics and How It Evades Detection
Which of the following is a characteristic of a polymorphic virus?
Quick Answer
The correct answer is that a polymorphic virus changes its code pattern every time it infects a new file or system. This mutation is its defining characteristic because it alters its own signature—often through encryption or variable instruction sequences—while preserving its core malicious functionality, specifically to evade signature-based detection tools used by antivirus software. On the Certified Ethical Hacker CEH exam, this concept tests your understanding of advanced evasion techniques; a common trap is confusing polymorphic viruses with metamorphic viruses, which rewrite their entire code rather than just mutating a decryption routine. Remember the memory tip: “Poly changes the lock, Meta changes the key”—polymorphic viruses change the appearance (the lock) but keep the same underlying payload (the key), forcing defenders to rely on behavior analysis rather than static signatures.
⚠ Common exam trap
A common mix-up: candidates confuse 'polymorphic' with 'metamorphic' viruses—polymorphic changes the decryptor but keeps the body constant, while metamorphic rewrites the entire code—or they mistakenly associate any self-changing behavior with worms or boot sector infections.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It changes its code pattern every time it infects a new file or system.
A polymorphic virus is designed to evade signature-based detection by mutating its code—typically using an encryption engine and a mutation engine—so that each infection generates a functionally identical but byte-wise different payload. This constant change in the virus's signature pattern prevents antivirus software from recognizing it through static file hashes or fixed byte sequences.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It changes its code pattern every time it infects a new file or system.
Why this is correct
Polymorphic viruses use encryption or other techniques to change their signature while preserving functionality.
- ✗
It spreads through network shares without requiring user interaction.
Why it's wrong here
This describes a worm, not a polymorphic virus.
- ✗
It remains dormant until a specific date or time.
Why it's wrong here
This describes a logic bomb or time bomb, not polymorphism.
- ✗
It infects the master boot record of a hard drive.
Why it's wrong here
This describes a boot sector virus, not necessarily polymorphic.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
8 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which of the following is a characteristic of a polymorphic virus?
easy- ✓ A.It changes its code pattern with each infection to evade detection
- B.It remains dormant until a specific date
- C.It spreads without user interaction
- D.It attaches to the boot sector of a hard drive
Why A: A polymorphic virus is designed to change its code pattern—often by using a mutation engine that generates new decryption routines or alters the payload's signature—each time it infects a new file or system. This constant mutation makes it difficult for signature-based antivirus solutions to detect it because the virus's binary fingerprint is never the same across infections.
Variation 2. Which TWO of the following are characteristics of a polymorphic virus? (Choose two.)
medium- A.It requires user interaction to activate
- ✓ B.It uses encryption to hide its payload
- C.It infects only the boot sector
- D.It spreads via email attachments only
- ✓ E.It changes its code signature each time it replicates
Why B: Polymorphic viruses use encryption to hide their payload from signature-based detection. Each time the virus replicates, it generates a new encryption key and a corresponding decryption routine, making the encrypted payload appear different while the underlying malicious code remains the same.
Variation 3. Which TWO of the following are characteristics of a polymorphic virus? (Choose 2)
medium- A.It does not require a host file to spread
- ✓ B.It changes its code signature each time it replicates
- ✓ C.It uses a mutation engine to generate new decryption routines
- D.It only infects the master boot record
- E.It attaches to email messages automatically
Why B: A polymorphic virus changes its code signature each time it replicates, which is its defining characteristic. This mutation is achieved by altering the decryption routine or the virus body itself, making signature-based detection difficult. The virus maintains its original functionality while evading static antivirus signatures.
Variation 4. Which TWO of the following are characteristics of a polymorphic virus? (Select 2)
medium- A.It spreads without user interaction.
- B.It attaches to a host file and does not change.
- ✓ C.It changes its code signature on each infection.
- ✓ D.It uses encryption to hide its payload.
- E.It only infects the boot sector.
Why C: A polymorphic virus mutates its code signature with each infection, using a mutation engine to generate new decryption routines or code patterns while preserving the core payload. This signature change evades signature-based detection by antivirus software, as the virus appears different in every infected file.
Variation 5. Which TWO of the following are characteristics of a polymorphic virus? (Select 2)
medium- A.It spreads via email attachments only
- ✓ B.It changes its code signature each time it replicates
- C.It requires a host file to attach
- D.It self-replicates without user interaction
- ✓ E.It uses encryption to hide its payload
Why B: A polymorphic virus mutates its code signature—often by altering the decryption routine or using different encryption keys—each time it replicates, which allows it to evade signature-based detection by antivirus software. Option E is correct because polymorphic viruses typically use encryption to hide their payload, with a variable decryption engine that changes the encrypted form of the virus body upon each infection.
Variation 6. Which TWO of the following are characteristics of a polymorphic virus?
medium- ✓ A.It changes its code signature each time it infects a new file
- B.It spreads via email attachments
- ✓ C.It uses encryption with a variable key
- D.It remains dormant until a specific date or time
- E.It can infect the Master Boot Record (MBR)
Why A: A polymorphic virus changes its decryption routine and code signature each time it infects a new file, making signature-based detection difficult. This mutation is achieved by using a polymorphic engine that generates varied decryption loops while preserving the malicious payload.
Variation 7. Which TWO of the following are characteristics of a polymorphic virus?
medium- ✓ A.It uses a decryption routine that varies
- B.It uses a constant signature across all infections
- ✓ C.It changes its code signature each time it replicates
- D.It can only infect boot sectors
- E.It always remains in memory
Why A: A polymorphic virus uses a decryption routine that varies with each infection, preventing signature-based detection. Option C is also correct because the changing decryption routine causes the virus's code signature to change each time it replicates, further evading signature matching.
Variation 8. Which type of malware is characterized by modifying its own code to evade signature-based detection, often changing its appearance each time it replicates?
medium- ✓ A.Polymorphic virus
- B.Trojan horse
- C.Macro virus
- D.Boot sector virus
Why A: A polymorphic virus is designed to change its code signature each time it replicates, using a mutation engine to generate new decryption routines or code patterns. This behavior allows it to evade signature-based detection by antivirus software, which relies on static patterns to identify threats.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.