FirstTry

Exam objective

CEH

Malware Threats

This objective sits in System Hacking Phases and Attack Techniques, which carries 15% of the CEH exam. The questions below are original, written from the official objective title above, and each explanation cites the EC-Council page it rests on.

Objective title verbatim from the official objectives. EC-Council exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

System Hacking Phases and Attack Techniques

An organization finds user documents and images renamed with a marker extension and unreadable, next to a note demanding payment for a key. Which impact technique is that?

Resource hijackingResource hijacking steals compute or bandwidth, such as mining, and leaves files readable.
Data encrypted for impactCorrect · your answerCorrect.
Data destructionDestruction leaves nothing to recover and offers no key, so no payment would help the victim.
Service stopStopping a service interrupts one application rather than making stored files unreadable.

Correct.

Checked against attack.mitre.org, September 2026

Concept

Withholding a key turns availability into a commodity the operator can sell. The files are intact and the owner simply cannot reach them, which is what separates this from wiping.

Why B

Rendering stored data inaccessible by encrypting it and withholding the decryption key, in exchange for money, is exactly the behavior the marker extensions and the payment note describe.

Source

Data Encrypted for Impact. Adversaries may encrypt data on target systems... withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware)... In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted (and often renamed and/or tagged with specific file markers).

MITRE ATT&CK, Data Encrypted for Impact (T1486), checked September 2026
#ransomware#impact#encryption

Now you: practice questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

System Hacking Phases and Attack Techniques

An analyst watches an encryptor reach hundreds of hosts using stolen accounts and admin shares, with no further operator action after the first host. What does that show?

Sample question 2 of 3

System Hacking Phases and Attack Techniques

A host's command log shows the lines below minutes before files were encrypted. What do those commands accomplish?

vssadmin.exe delete shadows /all /quietwbadmin.exe delete catalog -quietbcdedit.exe /set {default} recoveryenabled no

Sample question 3 of 3

System Hacking Phases and Attack Techniques

An operator deletes volume shadow copies and turns off the Windows Recovery Environment before running an encryptor. Which outcome does that step buy the operator?

That’s 3 of the full CEH bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in System Hacking Phases and Attack Techniques