SY0-701 Question 109
Single answer2.4 Given a scenario, analyze indicators of malicious activity.A security analyst is reviewing alerts from a file server after several users reported that shared documents suddenly became inaccessible. The analyst observes that thousands of files were renamed within minutes, many now have an unfamiliar extension, and a text file named READ_ME_NOW.txt appeared in multiple directories demanding payment for a decryption key. Which indicator most strongly suggests the server is experiencing a ransomware attack?
- A
Rapid file renaming combined with a ransom note appearing across directories
- B
A scheduled vulnerability scan detected several missing security patches
- C
Users are prompted to change their passwords at the next logon
- D
The server's backup job completed successfully overnight
Show answer and explanation
Correct answer: A
Explanation
The strongest indicator of ransomware in this scenario is the combination of mass file changes and the presence of a ransom note. Security professionals are expected to recognize behavioral indicators of malicious activity, not just underlying weaknesses. Common ransomware indicators include sudden file encryption, changed extensions, inaccessible documents, ransom instructions, and a high volume of file modifications in a short period. This aligns with widely accepted incident response guidance from organizations such as CISA and NIST, which emphasize identifying indicators of compromise based on observable system behavior. The other options describe normal administrative events or predisposing risk factors rather than direct signs of active ransomware.
- A. Correct.
Correct. Rapid, large-scale file renaming, the addition of unfamiliar file extensions, and the presence of ransom notes are classic indicators of ransomware activity. Ransomware commonly encrypts files, changes filenames or extensions, and leaves instructions for payment in text or HTML files throughout affected folders.
- B. Incorrect.
Incorrect. Missing patches increase risk and may explain how a system was compromised, but they are not themselves a direct indicator that ransomware is currently executing. This option describes a vulnerability condition, not evidence of active malicious encryption behavior.
- C. Incorrect.
Incorrect. Forced password changes can occur for many legitimate administrative or policy reasons, such as password expiration or incident response containment. By itself, this does not specifically indicate ransomware activity.
- D. Incorrect.
Incorrect. A successful backup job is generally a normal operational event. While backups are important for ransomware recovery, the completion of a backup does not indicate malicious activity and may even be unrelated to the current incident.