CEH Practice Question: Malware, Social Engineering and Network Attacks

Which TWO of the following are characteristics of a polymorphic virus? (Choose 2)

⚠ Common exam trap

Many exam-takers confuse polymorphic viruses with other malware types, such as worms (which spread without a host) or boot sector viruses (which target the MBR), leading them to select options that describe different malware categories.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

It changes its code signature each time it replicates

A polymorphic virus changes its code signature each time it replicates, which is its defining characteristic. This mutation is achieved by altering the decryption routine or the virus body itself, making signature-based detection difficult. The virus maintains its original functionality while evading static antivirus signatures.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
It does not require a host file to spread
Why it's wrong here
Polymorphic viruses, like all traditional viruses, are parasitic and require a host program or file to attach themselves to for propagation. They cannot exist or spread independently. This characteristic of not requiring a host file is a defining trait of a computer worm, which is a standalone malicious program capable of self-replication and spreading across networks without user intervention or attachment to other files.
✓
It changes its code signature each time it replicates
Why this is correct
A fundamental characteristic of a polymorphic virus is its ability to alter its executable code, or "signature," with each new infection or replication. This constant mutation makes it extremely difficult for traditional signature-based antivirus software to detect and identify the virus, as its binary pattern is never the same. The core malicious functionality remains intact, but its outward appearance changes, effectively evading static detection methods.
✓
It uses a mutation engine to generate new decryption routines
Why this is correct
Polymorphic viruses employ a specialized component known as a "mutation engine" or "polymorphic engine" to achieve their evasiveness. This engine is responsible for generating varied, yet functionally identical, decryption routines for the encrypted viral payload. Each time the virus replicates, the mutation engine creates a new, unique decryption stub, ensuring that the overall virus code appears different to security scanners while the core malicious logic remains functional.
✗
It only infects the master boot record
Why it's wrong here
While some viruses, known as boot sector viruses, specifically target and infect the Master Boot Record (MBR) or Volume Boot Record (VBR), this is not an exclusive or defining characteristic of polymorphic viruses. Polymorphic capabilities can be integrated into various types of malware, including file infectors, which target executable files, or even some worms. Therefore, limiting their infection scope solely to the MBR is an inaccurate generalization.
✗
It attaches to email messages automatically
Why it's wrong here
Automatic attachment to email messages for propagation is a common method employed by email worms, which are self-contained programs designed to spread rapidly across networks. While a polymorphic virus could theoretically be delivered via email as an attachment, its polymorphic nature refers to its code mutation capabilities, not its method of spreading. The mechanism of attaching to emails is a propagation vector, distinct from the virus's ability to change its signature.

Go deeper

CEH Practice Question: Malware, Social Engineering and Network Attacks

Why each option matters

Option-by-option breakdown

Related to this question