CEH Practice Question: Malware, Social Engineering and Network Attacks
Which type of malware is designed to replicate itself across networks without requiring a host file, often exploiting vulnerabilities to spread?
⚠ Common exam trap
It's easy for candidates to confuse a worm with a virus because both self-replicate, but the key differentiator is that a worm does not require a host file and spreads autonomously over networks, while a virus needs a host and user action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Worm
A worm is a standalone malware program that replicates itself across networks without needing a host file, typically exploiting vulnerabilities such as unpatched SMB services (e.g., EternalBlue in WannaCry) or weak credentials to propagate autonomously. Unlike viruses, worms do not require attachment to an existing executable or document, and they spread by scanning for vulnerable targets and transferring their code over network protocols like TCP/IP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Trojan
Why it's wrong here
A Trojan horse malware relies on social engineering to trick users into executing it, often by masquerading as benign software or a legitimate application. Unlike self-replicating malware, Trojans do not inherently possess the capability to spread autonomously across networks or systems; their propagation depends on user interaction or other delivery mechanisms. Once executed, they can perform various malicious activities, such as creating backdoors or stealing data, but they do not replicate themselves.
- ✗
Ransomware
Why it's wrong here
Ransomware is a type of malicious software primarily designed to deny access to a computer system or data by encrypting files until a ransom is paid, typically in cryptocurrency. Its core function is extortion, not autonomous self-replication across networks. While some advanced ransomware variants may incorporate worm-like propagation mechanisms to spread more effectively, their fundamental purpose remains data encryption and financial gain, distinguishing them from malware whose primary design is replication.
- ✓
Worm
Why this is correct
A worm is a standalone malicious program specifically designed to self-replicate and spread across computer networks without requiring a host program or user intervention. Worms exploit vulnerabilities in operating systems or applications to propagate autonomously, often consuming network bandwidth or system resources. Their defining characteristic is their ability to duplicate themselves and spread independently to other systems, making them highly effective at rapid dissemination.
- ✗
Virus
Why it's wrong here
A computer virus is a type of malware that attaches itself to legitimate programs or documents and requires a host file to execute and spread. Unlike worms, viruses cannot replicate independently; they depend on user interaction, such as opening an infected file, to activate and infect other files or systems. Their propagation is intrinsically linked to the execution of their host program, making them distinct from self-contained, self-replicating entities.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.