Polymorphic Virus: Key Characteristics and How It Evades Detection
Which TWO of the following are characteristics of a polymorphic virus? (Select 2)
⚠ Common exam trap
It's easy for candidates to confuse polymorphic viruses with worms (which spread without user interaction) or assume all viruses are static, overlooking the key defining feature of code mutation on each infection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It changes its code signature on each infection.
A polymorphic virus mutates its code signature with each infection, using a mutation engine to generate new decryption routines or code patterns while preserving the core payload. This signature change evades signature-based detection by antivirus software, as the virus appears different in every infected file.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It spreads without user interaction.
Why it's wrong here
This statement describes a characteristic of computer worms, which are standalone malware programs designed to replicate themselves and spread across networks without requiring a host program or user intervention. In contrast, a polymorphic virus, while sophisticated in its evasion techniques, still typically relies on attaching to a legitimate host file and requires that file to be executed, often by user action, to initiate its infection process.
- ✗
It attaches to a host file and does not change.
Why it's wrong here
This characteristic describes a traditional or "simple" file infector virus, which attaches its malicious code to an executable file and remains static in its form. A polymorphic virus, by definition, actively mutates its own code signature with each new infection, making it fundamentally different from a static virus that maintains an unchanging structure and signature.
- ✓
It changes its code signature on each infection.
Why this is correct
A defining characteristic of a polymorphic virus is its ability to alter its internal code structure and encryption key with every new infection. This constant mutation generates a unique code signature for each instance, making it extremely challenging for traditional signature-based antivirus software to detect and identify it consistently across different infected systems or files.
- ✓
It uses encryption to hide its payload.
Why this is correct
Polymorphic viruses frequently employ encryption to conceal their malicious payload, rendering the core functionality opaque to static analysis. Crucially, the encryption key and the decryption routine itself are often part of the polymorphic engine, which mutates with each infection, further complicating detection by presenting a constantly changing decryption stub to security scanners.
- ✗
It only infects the boot sector.
Why it's wrong here
This statement accurately describes a boot sector virus, which specifically targets and modifies the boot sector of a hard disk or removable media to gain control during system startup. While a polymorphic virus could potentially be designed to infect the boot sector, its defining characteristic is code mutation, not the exclusive targeting of a single infection vector like the boot sector.
About these practice questions
This CEH question is part of Courseiva's 913-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which type of malware is characterized by modifying its own code to evade signature-based detection, often changing its appearance each time it replicates?
medium- ✓ A.Polymorphic virus
- B.Trojan horse
- C.Macro virus
- D.Boot sector virus
Why A: A polymorphic virus is designed to change its code signature each time it replicates, using a mutation engine to generate new decryption routines or code patterns. This behavior allows it to evade signature-based detection by antivirus software, which relies on static patterns to identify threats.
Variation 2. Which TWO of the following are characteristics of a polymorphic virus?
medium- ✓ A.It uses a decryption routine that varies
- B.It uses a constant signature across all infections
- ✓ C.It changes its code signature each time it replicates
- D.It can only infect boot sectors
- E.It always remains in memory
Why A: A polymorphic virus uses a decryption routine that varies with each infection, preventing signature-based detection. Option C is also correct because the changing decryption routine causes the virus's code signature to change each time it replicates, further evading signature matching.
Variation 3. Which of the following is a characteristic of a polymorphic virus?
easy- ✓ A.It changes its code pattern with each infection to evade detection
- B.It remains dormant until a specific date
- C.It spreads without user interaction
- D.It attaches to the boot sector of a hard drive
Why A: A polymorphic virus is designed to change its code pattern—often by using a mutation engine that generates new decryption routines or alters the payload's signature—each time it infects a new file or system. This constant mutation makes it difficult for signature-based antivirus solutions to detect it because the virus's binary fingerprint is never the same across infections.
Variation 4. Which TWO of the following are characteristics of a polymorphic virus? (Choose 2)
medium- A.It does not require a host file to spread
- ✓ B.It changes its code signature each time it replicates
- ✓ C.It uses a mutation engine to generate new decryption routines
- D.It only infects the master boot record
- E.It attaches to email messages automatically
Why B: A polymorphic virus changes its code signature each time it replicates, which is its defining characteristic. This mutation is achieved by altering the decryption routine or the virus body itself, making signature-based detection difficult. The virus maintains its original functionality while evading static antivirus signatures.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.