A security team is investigating a malware outbreak. The malware is a file infector that uses a polymorphic engine to change its code each time it infects a new file. Traditional antivirus has failed to detect it. Which detection strategy would be most effective?

Use a honeypot to capture the malware for analysis.

Increase the frequency of signature updates.

Disable file sharing to prevent the malware from spreading.

Use behavioral monitoring to detect the malware's file infection activity.

A security analyst is examining a suspicious executable that changes its code signature each time it infects a new file. Static signature-based antivirus has not detected it. Which malware characteristic is the analyst observing, and which detection method would be more effective?

Polymorphic virus; use heuristic analysis to detect the underlying behavior

Stealth virus; use boot-time scanning to detect the virus

Metamorphic virus; use signature-based detection with updated definitions

Macro virus; use sandboxing to observe document behavior

Which characteristic is unique to a worm compared to a virus?

It self-propagates across networks without user interaction

It requires a host file to attach to

It hides inside a legitimate program

It encrypts files and demands a ransom

A security team is evaluating detection methods for a new malware variant that is polymorphic and uses a custom packer. Which two detection methods are most likely to be effective? Select all that apply.

Signature-based detection with updated definitions

Static analysis of the packed binary

Sandboxing that executes the malware in a controlled environment

Behavioral monitoring that flags unusual process behavior

Heuristic analysis that examines code structure

Which of the following is a common persistence mechanism used by malware on Windows systems?

Deleting the system restore points

Adding an entry to the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run registry key

EC-CouncilCertified Ethical Hacker

Domain 3Objective 7

Malware Threats (Trojans, Viruses, Ransomware) CEH Practice Questions (Page 2)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

10concepts

Questions 6–10

6expert · hard
A security team is investigating a malware outbreak. The malware is a file infector that uses a polymorphic engine to change its code each time it infects a new file. Traditional antivirus has failed to detect it. Which detection strategy would be most effective?
Select an answer first
7application · medium
A security analyst is examining a suspicious executable that changes its code signature each time it infects a new file. Static signature-based antivirus has not detected it. Which malware characteristic is the analyst observing, and which detection method would be more effective?
Select an answer first
8foundation · easy
Which characteristic is unique to a worm compared to a virus?
Select an answer first
9expert · hard · select all that apply
A security team is evaluating detection methods for a new malware variant that is polymorphic and uses a custom packer. Which two detection methods are most likely to be effective? Select all that apply.
Select an answer first
10foundation · easy
Which of the following is a common persistence mechanism used by malware on Windows systems?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.