CEH Practice Question: Malware, Social Engineering and Network Attacks
Which type of malware is characterized by self-replication and spreading across networks without needing a host file?
⚠ Common exam trap
EC-CEH often tests the distinction between a virus and a worm by emphasizing that a virus requires a host file to attach to, while a worm is self-contained and spreads independently over networks, leading candidates to mistakenly choose 'Virus' when they see 'self-replication' without noting the 'no host file' condition.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Worm
A worm is a standalone malware program that replicates itself to spread to other computers over a network, exploiting vulnerabilities or using social engineering, without requiring a host file or user intervention. Unlike viruses, worms do not need to attach to an existing program; they operate independently, often using network protocols like SMB, HTTP, or email to propagate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Trojan
Why it's wrong here
A Trojan horse is a type of malware that masquerades as legitimate software or a benign file to trick users into executing it. Unlike worms or viruses, Trojans do not possess the inherent capability to self-replicate or spread autonomously to other systems. Instead, their propagation relies entirely on social engineering tactics, requiring user interaction to install and activate their malicious payload, which can include remote access tools, data theft, or the installation of other malware.
- ✓
Worm
Why this is correct
A worm is a standalone malicious program designed to self-replicate and propagate across computer networks without requiring a host program or user intervention. Worms exploit vulnerabilities in operating systems or applications to spread autonomously, often scanning for vulnerable systems and then infecting them to continue their replication cycle. This independent self-replication and network-based propagation are their defining characteristics, allowing them to consume network bandwidth and system resources rapidly.
- ✗
Ransomware
Why it's wrong here
Ransomware is a category of malware that encrypts a victim's files or locks their computer system, demanding a ransom payment, typically in cryptocurrency, for decryption or access restoration. While highly destructive, ransomware itself is not primarily characterized by self-replication as its core propagation mechanism. It usually relies on other infection vectors, such as phishing emails, exploit kits, or being delivered as a payload by worms or Trojans, to initially compromise a system before executing its encryption routine.
- ✗
Virus
Why it's wrong here
A computer virus is a type of malicious software that attaches itself to a legitimate program or document, known as a host file, to execute its code. Unlike worms, a virus cannot run independently; it requires user interaction to open the infected host file, which then triggers the virus's execution and potential replication. Its defining characteristic is this dependency on a host program for both its existence and its ability to spread, often modifying other legitimate programs to include copies of itself.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.