nerdexam
GIAC

GSLC · Question #547

Which of the following types of virus is capable of changing its signature to avoid detection?

The correct answer is A. Polymorphic virus. This question tests recognition of the specific malware category that mutates its own code or encryption key with each replication to defeat signature-based antivirus detection.

Security Architecture & Engineering

Question

Which of the following types of virus is capable of changing its signature to avoid detection?

Options

  • APolymorphic virus
  • BBoot sector virus
  • CMacro virus
  • DStealth virus

How the community answered

(15 responses)
  • A
    87% (13)
  • C
    7% (1)
  • D
    7% (1)

Why each option

This question tests recognition of the specific malware category that mutates its own code or encryption key with each replication to defeat signature-based antivirus detection.

APolymorphic virusCorrect

A polymorphic virus uses a built-in mutation engine to alter its binary signature, encryption routine, or code structure with every infection cycle, ensuring that no two copies produce the same byte-level signature and thus evading traditional signature-based antivirus scanners while preserving its malicious payload.

BBoot sector virus

A boot sector virus infects the master boot record or volume boot record to persist across reboots and execute before the OS loads, but it does not mutate its own signature to evade detection.

CMacro virus

A macro virus embeds malicious code within document macros (such as in Microsoft Office files) and spreads through document sharing, but it does not change its own code or signature.

DStealth virus

A stealth virus hides its presence by intercepting operating system calls and returning falsified data to security tools, but unlike a polymorphic virus, it does not alter its own binary signature.

Concept tested: Polymorphic virus signature mutation for detection evasion

Source: https://csrc.nist.gov/glossary/term/polymorphic_malware

Topics

#polymorphic virus#signature evasion#malware types#antivirus detection

Community Discussion

No community discussion yet for this question.

Full GSLC Practice