CEH Practice Question: Malware, Social Engineering and Network Attacks

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  It spreads without user interaction.

  Why it's wrong here

  This statement describes a characteristic of computer worms, which are standalone malware programs designed to replicate themselves and spread across networks without requiring a host program or user intervention. In contrast, a polymorphic virus, while sophisticated in its evasion techniques, still typically relies on attaching to a legitimate host file and requires that file to be executed, often by user action, to initiate its infection process.

• ✗

  It attaches to a host file and does not change.

  Why it's wrong here

  This characteristic describes a traditional or "simple" file infector virus, which attaches its malicious code to an executable file and remains static in its form. A polymorphic virus, by definition, actively mutates its own code signature with each new infection, making it fundamentally different from a static virus that maintains an unchanging structure and signature.

• ✓

  It changes its code signature on each infection.

  Why this is correct

  A defining characteristic of a polymorphic virus is its ability to alter its internal code structure and encryption key with every new infection. This constant mutation generates a unique code signature for each instance, making it extremely challenging for traditional signature-based antivirus software to detect and identify it consistently across different infected systems or files.

• ✓

  It uses encryption to hide its payload.

  Why this is correct

  Polymorphic viruses frequently employ encryption to conceal their malicious payload, rendering the core functionality opaque to static analysis. Crucially, the encryption key and the decryption routine itself are often part of the polymorphic engine, which mutates with each infection, further complicating detection by presenting a constantly changing decryption stub to security scanners.

• ✗

  It only infects the boot sector.

  Why it's wrong here

  This statement accurately describes a boot sector virus, which specifically targets and modifies the boot sector of a hard disk or removable media to gain control during system startup. While a polymorphic virus could potentially be designed to infect the boot sector, its defining characteristic is code mutation, not the exclusive targeting of a single infection vector like the boot sector.

Go deeper

Related to this question