MPPSC 2025 Prelims Q22: A malware, that looks like a legitimate software and once

Q: What is the answer to MPPSC 2025 Prelims Q22?

C. Correct — C, Trojan. A Trojan (Trojan horse) is malware that disguises itself as legitimate, useful software — a free utility, a cracked application, a game, an email attachment or an installer — so that the user voluntarily runs it. Deception at the point of entry is its defining feature, which is exactly what the stem describes ('looks like a legitimate software and… tricks a user into installing it'). Once installed it delivers a payload — opening a backdoor for remote control, stealing data, or dropping further malware — so it then behaves much like a virus or worm. The one thing it does not do is replicate itself: a virus needs a host file, a worm spreads across a network on its own, while a Trojan needs a fooled human. The name comes from the wooden horse of Troy.

MPPSC 2025 Prelims Paper-I · Question 22 of 100

Verified against the official question paper. Answer as per the official MPPSC answer key.

A malware, that looks like a legitimate software and once it tricks a user into installing it, acts pretty much like a virus or worm, is known as:

(a)Keylogger
(b)Ransomware
(c)Trojan
(d)Spyware

Answer

Why

Correct — C, Trojan. A Trojan (Trojan horse) is malware that disguises itself as legitimate, useful software — a free utility, a cracked application, a game, an email attachment or an installer — so that the user voluntarily runs it. Deception at the point of entry is its defining feature, which is exactly what the stem describes ('looks like a legitimate software and… tricks a user into installing it'). Once installed it delivers a payload — opening a backdoor for remote control, stealing data, or dropping further malware — so it then behaves much like a virus or worm. The one thing it does not do is replicate itself: a virus needs a host file, a worm spreads across a network on its own, while a Trojan needs a fooled human. The name comes from the wooden horse of Troy.

Why the others are wrong

(a)Keylogger — A keylogger is defined by what it does after entry — it records keystrokes to capture passwords, PINs and card numbers. It is a surveillance payload, and is often delivered by a Trojan rather than being the disguise itself.
(b)Ransomware — Ransomware encrypts files or locks the device and then demands payment — it announces itself loudly, which is the opposite of the 'looks legitimate' behaviour described. It is a payload category, not a disguise.
(d)Spyware — Spyware covertly monitors activity and exfiltrates data. Its defining trait is stealthy surveillance after it is already inside, not masquerading as legitimate software to get in.

Concept

Malware is classified on two independent axes, and mixing them up is what makes these questions look hard. The first axis is how it spreads: a virus attaches to a host file and travels when that file is run; a worm self-replicates and moves across networks by itself; a Trojan does not replicate at all — it relies on tricking the user into installing it. The second axis is what it does once inside — the payload: ransomware (encrypt and extort), spyware and keyloggers (covert surveillance), adware, botnet agents. A single piece of malware can be a Trojan on the first axis and ransomware on the second.

All four options here are genuine malware terms, so recall of 'which one is malware' does not help — you must match the defining behaviour in the stem. The stem describes the entry method (disguise + user consent), so the answer must come from the propagation axis, and on that axis only 'Trojan' fits. Keylogger, ransomware and spyware all describe payloads.

Key facts

Trojan: disguised as legitimate software, installed by the user, does not self-replicate; typically opens a backdoor for remote access.
Virus attaches to a host file/program; a worm self-replicates and spreads over networks without any host or user action.
Ransomware encrypts data and demands a ransom (WannaCry and Petya, 2017, are the standard examples); spyware and keyloggers quietly harvest data and keystrokes.
CERT-In is India's national nodal agency for cyber-security incidents, designated under Section 70B of the Information Technology Act, 2000.

Malware — sorted by how it gets in and what it does

Virus→Spread: attaches to a host file; travels when the infected file is run

Worm→Spread: self-replicates across networks on its own, needs no host file

Trojan→Spread: disguised as legitimate software — the user installs it; no self-replication

Ransomware→Payload: encrypts files / locks the device and demands a ransom

Spyware / Keylogger→Payload: covert surveillance; keystroke and data capture

The stem describes the entry method — disguise plus user consent — so the answer comes from the 'how it spreads' column: Trojan.

Study next

Information Technology Act, 2000 — cyber offences and CERT-In under Section 70BSocial engineering: phishing, spear-phishing, vishing, spoofingRansomware case studies — WannaCry and Petya (2017)Indian Cyber Crime Coordination Centre (I4C) and the National Cyber Crime Reporting PortalDefensive basics: firewalls, antivirus, patching, two-factor authentication, digital signatures

Common traps

Calling every piece of malware a 'virus' — virus, worm and Trojan differ precisely in how they spread.
Assuming a Trojan replicates like a virus or worm — it does not; it needs a deceived user.
Confusing the delivery method (Trojan, phishing) with the payload (ransomware, spyware, keylogger).

Both MPPSC and UPSC keep this at definition level — one line describing the behaviour, and you supply the term (MPPSC 2018: denial of service; MPPSC 2023: phishing; UPSC 2018: WannaCry/Petya = cyber attacks).

Related PYQs

UPSC_2018_GS1_Q582018Open & attempt →

The terms 'WannaCry, Petya and EternalBlue' sometimes mentioned in the news recently are related to

(a) Exoplanets
(b) Cryptocurrency
(c) Cyber attacks
(d) Mini satellites

Answer(c) Cyber attacks

Same concept — identifying malware by name and behaviour; WannaCry and Petya are the ransomware siblings of the Trojan asked about here.

MPPSC_2023_PRE_PaperI_Q442023Open & attempt →

Which of the following is a type of cyber-attack that involves tricking users into revealing sensitive information?

(a) Phishing attack
(b) SQL Injection attack
(c) DOS attack
(d) None of the above

Answer(a) Phishing attack

The same 'match the deceptive technique to its name' pattern — phishing tricks the user into revealing data, a Trojan tricks the user into installing software.

Practice

practice — not a real PYQ
Which type of malware is self-replicating and spreads across a network without attaching itself to a host file?
- (a)Worm
- (b)Trojan
- (c)Keylogger
- (d)Adware
Answer(a) Worm — it copies itself and propagates over networks without a host file or user action.
practice — not a real PYQ
Under which Section of the Information Technology Act, 2000 is CERT-In designated as the national nodal agency for cyber-security incidents?
- (a)Section 43A
- (b)Section 66A
- (c)Section 70B
- (d)Section 79
Answer(c) Section 70B — it designates CERT-In as the national agency for incident response.