CEH Practice Question: Malware, Social Engineering and Network Attacks
Which type of malware encrypts the victim's files and demands payment for the decryption key?
⚠ Common exam trap
A common mix-up: candidates confuse ransomware with scareware (which displays fake warnings but does not encrypt files) or mistakenly think spyware or adware could also demand payment, but only ransomware specifically encrypts data and demands a decryption key in return.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ransomware
Ransomware is the correct answer because it specifically encrypts the victim's files using symmetric encryption (e.g., AES) and then demands a ransom payment, typically in cryptocurrency, in exchange for the decryption key. Unlike other malware types, its primary purpose is data hostage for financial extortion, often leveraging asymmetric encryption (e.g., RSA) to secure the symmetric key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Keylogger
Why it's wrong here
A keylogger is a type of surveillance software specifically designed to record every keystroke made on a target computer. Its primary function is to capture sensitive information such as usernames, passwords, and credit card numbers, transmitting them to an unauthorized party. This malware does not encrypt files or demand a ransom; its purpose is data theft through input monitoring.
- ✗
Spyware
Why it's wrong here
Spyware is a broad category of malicious software that secretly monitors and collects information about a user's activities without their knowledge or consent. This can include browsing history, email content, and application usage, often for data exfiltration or profiling. While intrusive, its core objective is covert data collection and surveillance, not the encryption of files for extortion.
- ✗
Adware
Why it's wrong here
Adware is software that automatically displays or downloads advertising material, often in the form of pop-up windows, banners, or redirecting browser traffic, to a user's computer. Its primary goal is revenue generation through advertising impressions or clicks. Although it can be intrusive and impact system performance, adware does not encrypt user files or demand payment for their release.
- ✓
Ransomware
Why this is correct
Ransomware is a malicious software that encrypts a victim's files, rendering them inaccessible, and subsequently demands a payment, typically in cryptocurrency, in exchange for the decryption key. This type of attack is specifically designed for financial extortion by holding critical data hostage. It directly matches the description of encrypting files and demanding a ransom for their recovery.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.