GSLC · Question #95
Which type of virus is able to alter its own code to avoid being detected by anti-virus software?
The correct answer is B. Polymorphic. This question tests the ability to identify a polymorphic virus by its defining characteristic of self-modifying code. Polymorphic viruses mutate their own code with each infection to evade signature-based antivirus detection.
Question
Which type of virus is able to alter its own code to avoid being detected by anti-virus software?
Options
- AMacro
- BPolymorphic
- CLogic Bomb
- DBoot sector
How the community answered
(31 responses)- B90% (28)
- C6% (2)
- D3% (1)
Why each option
This question tests the ability to identify a polymorphic virus by its defining characteristic of self-modifying code. Polymorphic viruses mutate their own code with each infection to evade signature-based antivirus detection.
Macro viruses embed themselves in document macros and execute within applications like Microsoft Office; they do not alter their own code to evade detection.
A polymorphic virus uses a mutation engine to rewrite its own code - changing variable names, instruction order, or encryption keys - with each replication cycle, producing new binary signatures that bypass static signature-based antivirus detection while preserving the original malicious functionality.
A logic bomb is malicious code that triggers upon a specific condition or date; it does not self-modify its code to avoid antivirus detection.
Boot sector viruses infect the master boot record or volume boot record of storage media; they rely on execution at boot time rather than code mutation to persist.
Concept tested: Polymorphic virus self-modifying code evasion technique
Source: https://www.cisa.gov/news-events/news/understanding-hidden-threats-rootkits-and-botnets
Topics
Community Discussion
No community discussion yet for this question.