CEH Practice Question: Malware, Social Engineering and Network Attacks

Which of the following is a characteristic of a polymorphic virus?

⚠ Common exam trap

Many exam-takers confuse 'polymorphic' with other malware types like worms or boot sector viruses, focusing on propagation methods or triggers instead of the defining characteristic of code mutation to evade signature-based detection.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

It changes its code pattern with each infection to evade detection

A polymorphic virus is designed to change its code pattern—often by using a mutation engine that generates new decryption routines or alters the payload's signature—each time it infects a new file or system. This constant mutation makes it difficult for signature-based antivirus solutions to detect it because the virus's binary fingerprint is never the same across infections.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
It changes its code pattern with each infection to evade detection
Why this is correct
Polymorphic malware, such as a polymorphic virus, possesses the sophisticated ability to alter its internal code structure and signature with every new infection or replication. This mutation typically involves encrypting its payload with a different key and using a varying decryption routine, making each instance appear unique. This constant code transformation is a primary tactic to bypass traditional signature-based antivirus software, which relies on identifying fixed patterns, thereby significantly increasing its stealth and persistence within a system.
✗
It remains dormant until a specific date
Why it's wrong here
This characteristic describes a time bomb or logic bomb, which is a malicious piece of code designed to execute its payload only when specific conditions are met, such as a particular date, time, or user action. While a polymorphic virus could incorporate a time bomb component, the ability to remain dormant until a specific date is a behavioral trait related to trigger mechanisms, not the fundamental method by which the malware alters its own code to evade detection, which is the defining feature of polymorphism.
✗
It spreads without user interaction
Why it's wrong here
The ability to spread autonomously without requiring user intervention is a defining characteristic of a computer worm. Worms are self-replicating malware that propagate across networks by exploiting vulnerabilities or misconfigurations, often consuming bandwidth and system resources. While a polymorphic engine could be incorporated into a worm to enhance its evasion capabilities, the core mechanism of spreading without user interaction describes a worm's propagation method, not the code mutation inherent to polymorphic malware.
✗
It attaches to the boot sector of a hard drive
Why it's wrong here
Attaching to the boot sector of a hard drive is a specific infection mechanism employed by boot sector viruses. These viruses infect the Master Boot Record (MBR) or the Volume Boot Record (VBR) of storage devices, ensuring they are loaded into memory and executed before the operating system starts. While a boot sector virus could also be polymorphic to evade detection, this statement describes its location and infection vector, not the dynamic code-changing characteristic that defines polymorphism itself.

Go deeper

CEH Practice Question: Malware, Social Engineering and Network Attacks

Why each option matters

Option-by-option breakdown

Related to this question