220-1102 Question 440
Single answerThreatsA user reports that after opening an email attachment labeled as an invoice, their Windows workstation becomes extremely slow and a message appears demanding payment in cryptocurrency to restore access to files. Shared department documents on a mapped network drive now have unfamiliar file extensions and cannot be opened by other users. Which threat has MOST likely infected the environment?
- A
Spyware
- B
Ransomware
- C
Rootkit
- D
Keylogger
Show answer and explanation
Correct answer: B
Explanation
The most likely threat is ransomware. The defining clues are encrypted files, changed file extensions, inability to open documents, and a demand for payment in cryptocurrency. The fact that shared files on a mapped network drive are also affected reflects a common real-world behavior of ransomware: it encrypts any accessible data using the current user's permissions. From a best-practice perspective, organizations should immediately isolate the affected system from the network, disable shared access if necessary, notify incident response or security personnel, and begin recovery using known-good backups rather than paying the ransom. Guidance from cybersecurity authorities such as CISA and the FBI consistently emphasizes prevention through user awareness, patching, endpoint protection, least privilege, and tested backups, and generally advises against paying ransom because payment does not guarantee file recovery and may encourage further attacks.
- A. Incorrect.
Spyware is designed to collect information about a user or system, such as browsing habits or credentials, often without consent. While spyware can slow a system, it does not typically encrypt files, rename them, and display a payment demand to restore access. A candidate might choose this because the infection began from an email attachment and the system became slow, but the file-encryption and extortion behavior specifically points elsewhere.
- B. Correct.
Ransomware is the correct answer because the scenario includes classic indicators: a malicious attachment, files becoming inaccessible, file extensions changing, impact spreading to a mapped network drive, and a ransom note demanding cryptocurrency payment. In real environments, ransomware commonly encrypts both local files and any connected shares the user has permission to access. This is a well-known threat category covered in A+ Core 2 security objectives.
- C. Incorrect.
A rootkit is designed to conceal malware or unauthorized access by hiding processes, files, or registry entries and maintaining privileged access. Although a rootkit could be part of a larger attack chain, it does not by itself explain the visible ransom demand and widespread file encryption. Someone might pick this option because rootkits are associated with serious compromise, but the presented symptoms align more directly with ransomware.
- D. Incorrect.
A keylogger captures keystrokes to steal credentials or sensitive information. It may be delivered through malicious email attachments, which makes it a plausible distractor, but it does not normally encrypt files, alter file extensions, or demand payment for file recovery. The main misconception here is confusing credential theft malware with extortion-based malware.