CEH Practice Question: Malware, Social Engineering and Network Attacks
Which type of malware is characterized by modifying its own code to evade signature-based detection, often changing its appearance each time it replicates?
⚠ Common exam trap
A common trap in CEH exams is confusing polymorphic malware (which changes its decryption routine) with metamorphic malware (which rewrites its entire code). Polymorphic malware uses a mutation engine but retains a fixed code body, while metamorphic malware changes its entire code structure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Polymorphic virus
A polymorphic virus is designed to change its code signature each time it replicates, using a mutation engine to generate new decryption routines or code patterns. This behavior allows it to evade signature-based detection by antivirus software, which relies on static patterns to identify threats.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Polymorphic virus
Why this is correct
A polymorphic virus is specifically designed to evade detection by antivirus software through continuous modification of its own code. Each new infection generates a unique, encrypted version of the virus body, coupled with a varying decryption routine. This constant mutation of its signature makes it extremely challenging for traditional signature-based detection systems to identify and quarantine, directly aligning with the characteristic of modifying its own code.
- ✗
Trojan horse
Why it's wrong here
A Trojan horse is a type of malware that disguises itself as legitimate software to trick users into executing it, often delivering a malicious payload such as a backdoor or data stealer. Unlike polymorphic viruses, Trojans do not possess self-replication capabilities or the ability to mutate their own code. Their primary function is to deliver their payload once executed, without altering their internal structure for evasion, making them non-polymorphic.
- ✗
Macro virus
Why it's wrong here
A macro virus infects documents and templates by embedding malicious code within the macro functionality of applications like Microsoft Office or LibreOffice. While highly effective at spreading through shared files, its defining characteristic is not code polymorphism. Macro viruses typically rely on the execution of their embedded scripts, rather than altering their own binary structure, to achieve their malicious objectives, though some could theoretically incorporate polymorphic traits.
- ✗
Boot sector virus
Why it's wrong here
A boot sector virus specifically targets and infects the boot sector of a hard drive or floppy disk, or the Master Boot Record (MBR), to ensure execution before the operating system loads. Its primary method of operation involves gaining control during the system startup sequence, allowing it to load itself into memory. These viruses are not inherently polymorphic; their evasion strategy relies more on their low-level system access rather than dynamic code mutation to avoid detection.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.