GSLC · Question #15
John works as a professional Ethical Hacker. He has been assigned a project to test the security He injects the virus on the server and, as a result, the server becomes infected with the virus even…
The correct answer is A. The virus, used by John, is not in the database of the antivirus program installed on the server. B. John has created a new virus. C. The mutation engine of the virus is generating a new encrypted code. D. John has changed the signature of the virus. All four options are independently valid technical reasons an antivirus program may fail to detect a virus, spanning unknown signatures, novel creation, polymorphic mutation, and manual signature alteration.
Question
John works as a professional Ethical Hacker. He has been assigned a project to test the security He injects the virus on the server and, as a result, the server becomes infected with the virus even though an established antivirus program is installed on the server. Which of the following do you think are the reasons why the antivirus installed on the server did not detect the virus injected by John? Each correct answer represents a complete solution. Choose all that apply.
Options
- AThe virus, used by John, is not in the database of the antivirus program installed on the server.
- BJohn has created a new virus.
- CThe mutation engine of the virus is generating a new encrypted code.
- DJohn has changed the signature of the virus.
How the community answered
(41 responses)- A100% (41)
Why each option
All four options are independently valid technical reasons an antivirus program may fail to detect a virus, spanning unknown signatures, novel creation, polymorphic mutation, and manual signature alteration.
Signature-based antivirus engines match files against a database of known virus signatures; any virus absent from that database will bypass detection regardless of how dangerous it is.
A newly created virus has no pre-existing signature in any antivirus vendor's database, making it an undetected zero-day threat by definition.
A polymorphic virus uses an internal mutation engine to re-encrypt and alter its code with each propagation cycle, producing unique byte patterns that never match a static database signature.
Manually modifying the binary signature of a known virus changes its byte sequence so it no longer matches the fingerprint stored in the antivirus database, effectively evading signature-based detection.
Concept tested: Antivirus evasion via polymorphism and signature modification
Topics
Community Discussion
No community discussion yet for this question.