CEH Practice Question: Malware, Social Engineering and Network Attacks

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  It uses a decryption routine that varies

  Why this is correct

  A polymorphic virus employs a sophisticated mutation engine that generates a unique decryption routine for each new infection instance. This varying decryption stub is prepended to the encrypted virus body, ensuring that the overall code signature changes every time the virus replicates. This constant alteration of the decryption mechanism is crucial for evading static signature-based antivirus detection, as the virus's executable form never presents the same byte pattern.

• ✗

  It uses a constant signature across all infections

  Why it's wrong here

  This statement is incorrect because the fundamental characteristic of a polymorphic virus is its ability to dynamically alter its code signature with each replication. By utilizing a mutation engine to generate unique decryption routines and often incorporating junk code or instruction reordering, the virus ensures that its binary pattern is never constant across infections. This continuous mutation is precisely what allows it to bypass traditional signature-based antivirus detection systems.

• ✓

  It changes its code signature each time it replicates

  Why this is correct

  This is a defining characteristic of polymorphic viruses, enabling them to evade detection. Each time a polymorphic virus replicates or infects a new file or system, it modifies its own executable code, typically by encrypting its core payload with a new key and generating a unique, varied decryption stub. This process results in a distinct code signature for every instance, making it extremely difficult for antivirus software relying on static signature matching to identify and block the threat effectively.

• ✗

  It can only infect boot sectors

  Why it's wrong here

  This statement is incorrect. Polymorphic viruses are not limited to infecting only boot sectors; they are highly versatile and can target various types of files and system areas. They commonly infect executable files (e.g., .EXE, .DLL, .COM), but can also infect boot sectors, master boot records (MBRs), or even document macros. Their polymorphic nature refers to their ability to change code, not a restriction on their infection vectors.

• ✗

  It always remains in memory

  Why it's wrong here

  This is an incorrect assertion. While some viruses, including certain polymorphic variants, may employ memory residence as a persistence mechanism to facilitate further infection or maintain control, it is not a mandatory or defining characteristic of polymorphism itself. Polymorphism specifically refers to the virus's ability to mutate its code's appearance, which can occur whether it's actively running in memory or residing dormant on disk, awaiting execution.

Go deeper

Related to this question