nerdexam
GIAC

GSLC · Question #95

Which type of virus is able to alter its own code to avoid being detected by anti-virus software?

The correct answer is B. Polymorphic. This question tests the ability to identify a polymorphic virus by its defining characteristic of self-modifying code. Polymorphic viruses mutate their own code with each infection to evade signature-based antivirus detection.

Security Architecture & Engineering

Question

Which type of virus is able to alter its own code to avoid being detected by anti-virus software?

Options

  • AMacro
  • BPolymorphic
  • CLogic Bomb
  • DBoot sector

How the community answered

(31 responses)
  • B
    90% (28)
  • C
    6% (2)
  • D
    3% (1)

Why each option

This question tests the ability to identify a polymorphic virus by its defining characteristic of self-modifying code. Polymorphic viruses mutate their own code with each infection to evade signature-based antivirus detection.

AMacro

Macro viruses embed themselves in document macros and execute within applications like Microsoft Office; they do not alter their own code to evade detection.

BPolymorphicCorrect

A polymorphic virus uses a mutation engine to rewrite its own code - changing variable names, instruction order, or encryption keys - with each replication cycle, producing new binary signatures that bypass static signature-based antivirus detection while preserving the original malicious functionality.

CLogic Bomb

A logic bomb is malicious code that triggers upon a specific condition or date; it does not self-modify its code to avoid antivirus detection.

DBoot sector

Boot sector viruses infect the master boot record or volume boot record of storage media; they rely on execution at boot time rather than code mutation to persist.

Concept tested: Polymorphic virus self-modifying code evasion technique

Source: https://www.cisa.gov/news-events/news/understanding-hidden-threats-rootkits-and-botnets

Topics

#polymorphic virus#malware#antivirus evasion

Community Discussion

No community discussion yet for this question.

Full GSLC Practice