200-201 Security Concepts Practice Question
Which type of malware is designed to encrypt files on a victim's system and demand payment for the decryption key?
⚠ Common exam trap
Cisco often tests the distinction between ransomware and Trojan horses, where candidates mistakenly choose Trojan horse because they associate it with malicious software that tricks users, but the key differentiator is that ransomware specifically encrypts files for extortion, whereas a Trojan horse may have various payloads like backdoors or keyloggers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ransomware
Ransomware is the correct answer because it is specifically designed to encrypt files on a victim's system using a symmetric or asymmetric encryption algorithm (e.g., AES-256, RSA-2048) and then demand a ransom payment, typically in cryptocurrency, in exchange for the decryption key. This type of malware directly targets data availability, a core component of the CIA triad, by rendering files inaccessible until the ransom is paid.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Rootkit
Why it's wrong here
A rootkit conceals its presence by subverting operating-system calls, granting persistent privileged access. It does not encrypt user files or extort payment. Rootkit is correct when the scenario describes hidden, sustained access that resists detection and removal.
- ✗
Worm
Why it's wrong here
Worms self-replicate across networks via vulnerabilities, spreading without user action; they do not encrypt files or demand ransom. The scenario describes ransomware, which holds data hostage until payment. Worms would be the answer if the question asked about self-propagating malware that consumes bandwidth and infects hosts automatically.
- ✗
Trojan horse
Why it's wrong here
A Trojan horse disguises malicious code inside legitimate-looking software, relying on the user to execute it. It does not itself encrypt files or display a payment demand. Trojan is correct when the scenario describes malware delivered through deceptive user-initiated installation.
- ✓
Ransomware
Why this is correct
Ransomware encrypts victim files using symmetric or hybrid cryptography, rendering data inaccessible until a decryption key is supplied. This directly matches the stem's constraint of encryption plus payment demand, distinguishing it from worms, trojans or spyware, which do not extort via cryptographic locking.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.