nerdexam
GIAC

GSLC · Question #15

John works as a professional Ethical Hacker. He has been assigned a project to test the security He injects the virus on the server and, as a result, the server becomes infected with the virus even…

The correct answer is A. The virus, used by John, is not in the database of the antivirus program installed on the server. B. John has created a new virus. C. The mutation engine of the virus is generating a new encrypted code. D. John has changed the signature of the virus. All four options are independently valid technical reasons an antivirus program may fail to detect a virus, spanning unknown signatures, novel creation, polymorphic mutation, and manual signature alteration.

Security Architecture & Engineering

Question

John works as a professional Ethical Hacker. He has been assigned a project to test the security He injects the virus on the server and, as a result, the server becomes infected with the virus even though an established antivirus program is installed on the server. Which of the following do you think are the reasons why the antivirus installed on the server did not detect the virus injected by John? Each correct answer represents a complete solution. Choose all that apply.

Options

  • AThe virus, used by John, is not in the database of the antivirus program installed on the server.
  • BJohn has created a new virus.
  • CThe mutation engine of the virus is generating a new encrypted code.
  • DJohn has changed the signature of the virus.

How the community answered

(41 responses)
  • A
    100% (41)

Why each option

All four options are independently valid technical reasons an antivirus program may fail to detect a virus, spanning unknown signatures, novel creation, polymorphic mutation, and manual signature alteration.

AThe virus, used by John, is not in the database of the antivirus program installed on the server.Correct

Signature-based antivirus engines match files against a database of known virus signatures; any virus absent from that database will bypass detection regardless of how dangerous it is.

BJohn has created a new virus.Correct

A newly created virus has no pre-existing signature in any antivirus vendor's database, making it an undetected zero-day threat by definition.

CThe mutation engine of the virus is generating a new encrypted code.Correct

A polymorphic virus uses an internal mutation engine to re-encrypt and alter its code with each propagation cycle, producing unique byte patterns that never match a static database signature.

DJohn has changed the signature of the virus.Correct

Manually modifying the binary signature of a known virus changes its byte sequence so it no longer matches the fingerprint stored in the antivirus database, effectively evading signature-based detection.

Concept tested: Antivirus evasion via polymorphism and signature modification

Topics

#antivirus evasion#polymorphic virus#mutation engine#virus signature

Community Discussion

No community discussion yet for this question.

Full GSLC Practice