CEH Practice Question: Malware, Social Engineering and Network Attacks
Which type of malware is characterized by its ability to spread without requiring a host file and can replicate across networks automatically?
⚠ Common exam trap
It's easy for candidates to confuse a worm's self-replication with a virus's need for a host file, leading them to select 'Virus' because they associate malware spread with file infection, ignoring the worm's autonomous network propagation capability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Worm
A worm is a standalone malware program that replicates itself across networks without requiring a host file or user intervention. It exploits network vulnerabilities, such as unpatched services or weak credentials, to propagate automatically, often using protocols like SMB, RDP, or email transport mechanisms.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Virus
Why it's wrong here
A virus is a type of malicious software that requires a host program or file to execute and propagate. It inserts its malicious code into legitimate applications or documents, relying on user interaction (e.g., opening an infected file) to activate and spread to other files on the same system or network. Unlike a worm, a virus cannot self-replicate independently across networks without a host and user intervention.
- ✗
Trojan
Why it's wrong here
A Trojan horse is a deceptive type of malware that masquerades as a legitimate or desirable program to trick users into executing it. Once activated, it performs malicious actions, such as creating backdoors, stealing data, or installing other malware. Crucially, a Trojan lacks the inherent ability to self-replicate or spread autonomously to other systems; its propagation relies entirely on social engineering and user execution.
- ✓
Worm
Why this is correct
A worm is a standalone malicious program designed to self-replicate and propagate autonomously across computer networks without requiring a host program or user intervention. It exploits network vulnerabilities or configuration weaknesses to spread from one system to another, consuming bandwidth and system resources. This self-replicating capability is its defining characteristic, allowing it to infect numerous machines rapidly.
- ✗
Ransomware
Why it's wrong here
Ransomware is a category of malware that encrypts a victim's files or locks their computer system, demanding a ransom payment, typically in cryptocurrency, for decryption or access restoration. While highly destructive, its primary function is data encryption and extortion, not autonomous self-replication across networks. Ransomware often relies on other infection vectors, such as phishing emails or exploit kits, for initial delivery rather than inherent self-propagation.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.