CEH Practice Question: Malware, Social Engineering and Network Attacks
Which TWO of the following are features of a Remote Access Trojan (RAT)?
⚠ Common exam trap
Watch out — candidates often confuse a RAT with other malware types, such as ransomware (option A) or worms (option C), because they all involve malicious code, but the CEH exam specifically tests the unique remote-control and backdoor capabilities that define a RAT.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It often includes a backdoor to bypass authentication
A Remote Access Trojan (RAT) is designed to provide an attacker with covert remote control over an infected system, often including a backdoor to bypass standard authentication mechanisms. This allows the attacker to execute commands, exfiltrate data, or use the system as a pivot point, which directly aligns with options D and E.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It encrypts files and demands ransom
Why it's wrong here
This statement describes ransomware, a distinct category of malware. Ransomware's primary function is to encrypt a victim's files or lock their system, subsequently demanding a payment, typically in cryptocurrency, for decryption or access restoration. Remote Access Trojans (RATs), conversely, are designed for covert remote administration and data exfiltration, not file encryption for ransom, making this an incorrect characteristic.
- ✗
It infects the Master Boot Record
Why it's wrong here
Infecting the Master Boot Record (MBR) is a characteristic behavior of bootkits or certain types of rootkits, which aim to gain control of the system very early in the boot process, before the operating system loads. This allows them to hide their presence and maintain persistence. Remote Access Trojans (RATs) typically operate within the user space or kernel space after the OS has loaded, focusing on remote command and control rather than pre-boot system compromise.
- ✗
It replicates itself across the network autonomously
Why it's wrong here
Autonomous self-replication across a network is a defining characteristic of computer worms. Worms are designed to spread independently, exploiting vulnerabilities or using social engineering to propagate to other systems without requiring a host file or direct user intervention for their spread. Remote Access Trojans (RATs) are typically delivered via social engineering, exploit kits, or bundled with legitimate software, and do not inherently possess self-replication capabilities.
- ✓
It often includes a backdoor to bypass authentication
Why this is correct
A fundamental feature of many Remote Access Trojans (RATs) is the establishment of a backdoor. This backdoor provides a covert method for the attacker to regain access to the compromised system, often bypassing standard authentication mechanisms like usernames and passwords. This ensures persistent control, even if the initial exploit vector is patched or the user changes credentials, facilitating long-term surveillance or data exfiltration.
- ✓
It provides the attacker with remote control over the infected system
Why this is correct
The core functionality of a Remote Access Trojan (RAT) is to grant an attacker comprehensive remote control over the infected system. This typically includes capabilities such as executing arbitrary commands, manipulating files, capturing screenshots, logging keystrokes, accessing webcams and microphones, and exfiltrating sensitive data. Essentially, a RAT transforms the victim's machine into a remotely manageable zombie, allowing the attacker to perform actions as if they were physically present.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.