CEH Cryptography and Malware Analysis Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Remains constant in code to ensure replication

  Why it's wrong here

  A core characteristic of polymorphic viruses is their ability to alter their internal structure. Therefore, remaining constant in code directly contradicts the definition of polymorphism, which involves continuous mutation. Such a static code pattern would render the virus easily detectable by signature-based antivirus solutions, failing to achieve its primary objective of stealth and persistence. This constancy would be a fatal flaw for a polymorphic threat.

• ✓

  Mutates its code to evade signature detection

  Why this is correct

  Polymorphic viruses are specifically designed with a mutation engine that generates a different, functionally identical variant of the virus body with each replication. This constant alteration of their code signature, including instruction sequences and encryption routines, makes it extremely challenging for traditional signature-based antivirus software to identify and block them. The primary goal of this mutation is to bypass detection mechanisms that rely on fixed patterns.

• ✓

  Uses encryption with a variable key

  Why this is correct

  Many polymorphic viruses employ encryption to conceal their malicious payload, with a small decryption routine preceding the encrypted body. Crucially, they utilize a variable encryption key that changes with each infection instance, ensuring that the encrypted virus body appears different every time. This technique, combined with a mutating decryption routine, further complicates signature generation and detection by security software.

• ✗

  Spreads via network shares

  Why it's wrong here

  While some malware, including certain polymorphic variants, might leverage network shares for propagation, spreading via network shares is a characteristic of malware delivery mechanisms or worm-like behavior, not an inherent defining trait of polymorphism itself. Polymorphism describes how a virus changes its code, irrespective of its specific method of initial infection or lateral movement within a network. Worms are particularly known for this self-propagating capability.

• ✗

  Resides in the boot sector of a hard drive

  Why it's wrong here

  Residing in the boot sector is a specific infection location characteristic, defining a category known as boot sector viruses. This describes where the malware physically stores itself and executes upon system startup, rather than how its code behaves or changes. Polymorphism, in contrast, refers to the virus's ability to alter its own code structure, which can be implemented by various types of malware, including those that might or might not infect the boot sector.

Go deeper

Related to this question