GCFA · Question #142
John works as a professional Ethical Hacker. He has been assigned a project to test the security injects the virus on the server and, as a result, the server becomes infected with the virus even thoug
The correct answer is A. The mutation engine of the virus is generating a new encrypted code. B. The virus, used by John, is not in the database of the antivirus program installed on the server. C. John has created a new virus. D. John has changed the signature of the virus.. Antivirus software can fail to detect a virus when the virus is new or unknown, has had its signature altered, or uses a polymorphic mutation engine that continuously generates new encrypted variants. All four choices represent valid and distinct reasons for antivirus evasion.
Question
John works as a professional Ethical Hacker. He has been assigned a project to test the security injects the virus on the server and, as a result, the server becomes infected with the virus even though an established antivirus program is installed on the server. Which of the following do you think are the reasons why the antivirus installed on the server did not detect the virus injected by John? Each correct answer represents a complete solution. Choose all that apply.
Options
- AThe mutation engine of the virus is generating a new encrypted code.
- BThe virus, used by John, is not in the database of the antivirus program installed on the server.
- CJohn has created a new virus.
- DJohn has changed the signature of the virus.
How the community answered
(33 responses)- A100% (33)
Why each option
Antivirus software can fail to detect a virus when the virus is new or unknown, has had its signature altered, or uses a polymorphic mutation engine that continuously generates new encrypted variants. All four choices represent valid and distinct reasons for antivirus evasion.
Polymorphic viruses use a mutation engine to generate new encrypted code variants with each infection cycle, continuously changing their binary pattern so that signature-based antivirus engines cannot match them against known definitions in the database.
Signature-based antivirus programs rely entirely on a database of known virus signatures, so any virus whose signature is absent from that database will pass undetected through the scanning process.
A newly created virus has no existing signature catalogued in any antivirus vendor's database, making it completely invisible to signature-based detection until security researchers discover, analyze, and publish a definition update.
Manually altering or obfuscating a virus's signature through packing, encryption, or code-level modification prevents the antivirus engine from matching it to its stored definition, effectively bypassing detection even when the base virus is known.
Concept tested: Antivirus evasion techniques and polymorphic viruses
Topics
Community Discussion
No community discussion yet for this question.