CEH Practice Question: Malware, Social Engineering and Network Attacks

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  It spreads via email attachments only

  Why it's wrong here

  Polymorphic viruses are not restricted to spreading solely through email attachments. While email is a common vector for many types of malware, polymorphic viruses, like other sophisticated threats, can propagate via numerous methods. These include infected removable media, compromised websites, network shares, and exploiting software vulnerabilities, making the "email attachments only" claim inaccurate and overly restrictive for this class of malware.

• ✓

  It changes its code signature each time it replicates

  Why this is correct

  A defining characteristic of a polymorphic virus is its ability to alter its internal code structure and signature with each new infection or replication. This mutation is achieved through a polymorphic engine, which modifies the virus's instruction set and encryption key while preserving its malicious payload and functionality. This constant change makes it exceptionally challenging for traditional signature-based antivirus solutions to identify and block the malware consistently.

• ✗

  It requires a host file to attach

  Why it's wrong here

  While many viruses, including some polymorphic variants, do indeed require a host file to attach themselves to for execution and propagation, this characteristic is not exclusive or defining for polymorphic malware. This trait is common to most traditional file infector viruses. Other malware types, such as worms, can self-replicate and spread independently without needing to infect an existing host file, demonstrating that host file attachment is not a unique identifier for polymorphic behavior.

• ✗

  It self-replicates without user interaction

  Why it's wrong here

  The ability to self-replicate without any user interaction is a primary characteristic of a computer worm, not inherently a defining trait of a polymorphic virus. While a polymorphic engine could be incorporated into a worm, many polymorphic viruses still require some form of user action, such as executing an infected program or opening a malicious document, to initiate their initial infection and subsequent propagation cycle. Therefore, this statement is too broad and not specific to polymorphic viruses.

• ✓

  It uses encryption to hide its payload

  Why this is correct

  Polymorphic viruses frequently employ encryption as a core technique to conceal their malicious payload and evade detection. The main body of the virus is encrypted, and only a small, constantly changing decryption routine (the polymorphic engine) is left in plain sight. This encryption ensures that the static signature of the payload remains hidden from antivirus scanners, as only the dynamic decryptor stub changes with each iteration, making signature-based detection extremely difficult.

Go deeper

Related to this question