CEH Practice Question: Malware, Social Engineering and Network Attacks

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  It requires user interaction to activate

  Why it's wrong here

  Polymorphic viruses do not inherently require user interaction for activation. While some instances may rely on a user opening an infected file, their activation mechanism is entirely separate from their polymorphic nature. These viruses can also be triggered by exploiting system vulnerabilities, through auto-run features, or via scheduled tasks, demonstrating that the method of execution is not a defining characteristic of polymorphism itself.

• ✓

  It uses encryption to hide its payload

  Why this is correct

  A fundamental characteristic of polymorphic viruses is their sophisticated use of encryption to conceal their malicious payload. This encryption renders the core malicious code unreadable to static analysis tools, making it difficult to identify based on fixed patterns. Crucially, the virus dynamically generates a new, unique decryption routine with each replication, ensuring that even the decryption stub constantly changes, further evading signature-based detection.

• ✗

  It infects only the boot sector

  Why it's wrong here

  Infecting only the boot sector is not a defining characteristic of polymorphic viruses. While some early polymorphic viruses, like the "Satanbug," did target the boot sector, polymorphism is a technique that can be applied to various malware types. This includes file infectors, macro viruses, and network worms, which can target executable files, document macros, or network protocols, respectively, rather than being confined to a specific system area.

• ✗

  It spreads via email attachments only

  Why it's wrong here

  The method of spreading, such as exclusively via email attachments, is not a defining characteristic of a polymorphic virus. Polymorphism refers to the virus's ability to alter its internal code structure, not its propagation vector. Polymorphic malware can utilize a wide array of infection vectors, including removable media, network shares, drive-by downloads, and exploit kits, in addition to email, to disseminate itself.

• ✓

  It changes its code signature each time it replicates

  Why this is correct

  The defining characteristic of a polymorphic virus is its ability to change its code signature each time it replicates. This is achieved through a mutation engine that modifies the virus's instruction set, register usage, and decryption routine, creating a new, unique variant with every infection. This constant alteration generates a different binary pattern for each instance, making it exceptionally difficult for traditional signature-based antivirus software to detect consistently.

Go deeper

Related to this question