CEH Practice Question: Malware, Social Engineering and Network Attacks

Which type of malware is designed to encrypt files on a victim's system and demand payment for the decryption key?

⚠ Common exam trap

A common mix-up: candidates confuse ransomware with a Trojan because some ransomware is delivered via Trojan droppers, but the defining characteristic is the encryption and ransom demand, not the delivery method.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Ransomware

Ransomware is specifically designed to encrypt files on a victim's system using strong cryptographic algorithms (e.g., AES-256 for symmetric encryption, often paired with RSA-2048 for key exchange). After encryption, the malware displays a ransom note demanding payment (typically in cryptocurrency like Bitcoin) in exchange for the decryption key. This matches the description exactly, making option A correct.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Ransomware
Why this is correct
Ransomware is a specific type of malicious software meticulously designed to encrypt a victim's files or lock access to their computer system. Its primary objective is extortion, demanding a ransom payment, typically in cryptocurrency, in exchange for a decryption key or restoration of access. Failure to pay often results in permanent data loss or continued system lockout, making it a highly destructive threat.
✗
Trojan
Why it's wrong here
A Trojan horse is a type of malware that masquerades as legitimate software to trick users into executing it. Once activated, it creates a backdoor, allowing malicious actors to gain unauthorized access and control over the compromised system. While a Trojan can *deliver* various payloads, including ransomware, its fundamental design is deception and payload delivery, not the file encryption and ransom demand itself.
✗
Spyware
Why it's wrong here
Spyware is malicious software specifically engineered to secretly monitor and collect information about a user's activities without their knowledge or consent. This can include keystrokes, browsing history, application usage, and sensitive personal data, which is then transmitted to an attacker. Its core function is clandestine data exfiltration and surveillance, not the encryption of files for extortion purposes.
✗
Adware
Why it's wrong here
Adware is software that automatically displays unwanted or intrusive advertisements, often in the form of pop-ups, banners, or redirects, to generate revenue for its creator. While it can degrade system performance and user experience, its primary function is advertising delivery and data collection for targeted ads, not the encryption of user files or system lockout for ransom.

Quick reference

Symmetric Encryption Algorithm Comparison

Algorithm	Key Size	Block Size	Status	Notes
AES-128	128-bit	128-bit	Current standard	NIST approved; WPA3, TLS
AES-256	256-bit	128-bit	Current standard	Preferred for sensitive / govt data
3DES	112-bit effective	64-bit	Deprecated (2023)	Replaced by AES
DES	56-bit	64-bit	Broken	Cracked in < 24 h; never deploy
ChaCha20	256-bit	Stream cipher	Current	TLS 1.3, WireGuard

Go deeper

CEH Practice Question: Malware, Social Engineering and Network Attacks

Why each option matters

Option-by-option breakdown

Symmetric Encryption Algorithm Comparison

Related to this question