CEH Practice Question: Malware, Social Engineering and Network Attacks
Which type of malware is characterized by encrypting a victim's files and demanding a ransom payment for the decryption key?
⚠ Common exam trap
It's easy for candidates to confuse ransomware with other malware that causes data loss or system disruption, but the key differentiator is the specific combination of file encryption and ransom demand for the decryption key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ransomware
Ransomware is the correct answer because it specifically encrypts files on the victim's system using strong encryption algorithms (e.g., AES-256 or RSA) and then demands a ransom payment, typically in cryptocurrency, to provide the decryption key. This matches the description exactly, distinguishing it from other malware types that do not perform file encryption for extortion.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Spyware
Why it's wrong here
Spyware is designed to secretly monitor and collect personal or organizational information from a victim's computer without their knowledge or consent. This data, which can include browsing history, email content, and system configurations, is then transmitted to a remote attacker. Its primary function is clandestine data exfiltration, not file encryption or system lockout.
- ✗
Adware
Why it's wrong here
Adware is a type of software that automatically displays or downloads advertising material, often in the form of pop-up windows or banners, to a user's computer. While it can be intrusive and degrade system performance, its core purpose is revenue generation through advertising, not data encryption or holding files hostage. It focuses on unsolicited commercial content delivery.
- ✗
Keylogger
Why it's wrong here
A keylogger is a surveillance technology used to record every keystroke made on a specific computer keyboard. Its primary objective is to capture sensitive information such as usernames, passwords, credit card numbers, and other confidential data entered by the user. This information is then typically sent to an attacker, but the malware itself does not encrypt files on the victim's system.
- ✓
Ransomware
Why this is correct
Ransomware is a malicious software that encrypts a victim's files, rendering them inaccessible, and then demands a ransom payment, typically in cryptocurrency, for the decryption key. This type of malware explicitly holds data hostage, threatening permanent data loss if the payment is not made within a specified timeframe. Its defining characteristic is the encryption of user data and the subsequent extortion attempt.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.