nerdexam
GIAC

GSLC · Question #333

Which of the following encrypts its code differently with each infection or generation of infections?

The correct answer is C. Polymorphic virus. A polymorphic virus mutates its own code or encryption with each replication cycle, making signature-based detection extremely difficult.

Security Operations & Incident Response Leadership

Question

Which of the following encrypts its code differently with each infection or generation of infections?

Options

  • ABoot sector virus
  • BStealth virus
  • CPolymorphic virus
  • DMacro virus

How the community answered

(29 responses)
  • A
    7% (2)
  • B
    3% (1)
  • C
    90% (26)

Why each option

A polymorphic virus mutates its own code or encryption with each replication cycle, making signature-based detection extremely difficult.

ABoot sector virus

A boot sector virus infects the master boot record or volume boot record but does not change or re-encrypt its own code between infections.

BStealth virus

A stealth virus intercepts system calls to hide its presence from the OS and AV tools but does not modify its own code encryption per infection.

CPolymorphic virusCorrect

A polymorphic virus uses a built-in mutation engine to re-encrypt or alter its code signature with every new infection or generation. This means each copy of the virus looks different to antivirus scanners, preventing simple hash or signature matching. It is distinct from a metamorphic virus, which rewrites its entire body, but both share the goal of evading static detection.

DMacro virus

A macro virus embeds itself in document macros and spreads when infected documents are opened but uses a fixed code body, not per-infection encryption.

Concept tested: Polymorphic virus code mutation and AV evasion

Source: https://www.cisa.gov/sites/default/files/publications/Understanding-Malware.pdf

Topics

#polymorphic virus#malware evasion#code encryption#virus types

Community Discussion

No community discussion yet for this question.

Full GSLC Practice