CEH Practice Question: Malware, Social Engineering and Network Attacks
Which of the following is a type of malware that replicates itself by attaching to executable files and requires human action to spread, such as opening an infected attachment?
⚠ Common exam trap
Many candidates confuse a file virus with a worm because both can spread via email attachments, but the key differentiator is that a worm self-replicates without human interaction, while a file virus requires the user to execute the infected file.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
File virus
A file virus (also known as a file infector) is a type of malware that replicates by inserting its code into executable files (e.g., .exe, .com, .dll). It requires human action to spread, such as opening an infected email attachment or running an infected program, because the virus code is only activated when the host executable is executed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Worm
Why it's wrong here
Worms are a distinct category of self-replicating malware that primarily spread across computer networks by exploiting vulnerabilities in operating systems or applications. Unlike viruses, worms do not typically attach to existing host files; instead, they are standalone programs that can propagate autonomously, often without any user interaction. Their replication consumes network bandwidth and system resources, leading to performance degradation and widespread infection.
- ✗
Ransomware
Why it's wrong here
Ransomware is a type of malicious software designed to block access to a computer system or encrypt data until a ransom is paid, typically in cryptocurrency. Its primary objective is financial extortion through data denial, not self-replication. While ransomware can spread within a network, it often relies on other delivery mechanisms like phishing emails or exploit kits for initial infection and propagation, rather than possessing inherent self-replicating capabilities as its defining characteristic.
- ✓
File virus
Why this is correct
A file virus is a classic form of malware that replicates by attaching its malicious code to legitimate executable files or scripts on a host system. When an infected program is executed, the virus code runs first, often infecting other uninfected files on the same system or accessible network drives. This direct modification and execution-based propagation mechanism is a fundamental characteristic of file viruses, making them a clear example of replicating malware.
- ✗
Trojan
Why it's wrong here
A Trojan horse, or Trojan, is a type of malware that disguises itself as legitimate software to trick users into installing it. Unlike viruses or worms, Trojans do not possess the ability to self-replicate or spread autonomously to other systems. Instead, they rely entirely on social engineering tactics or other malware to be delivered and executed by an unsuspecting user, after which they perform their hidden malicious functions, such as creating backdoors or stealing data.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.