SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A file server suddenly renames documents, creates ransom notes, and users can no longer open their files. Which malware type is most likely involved?
⚠ Common exam trap
A common mix-up: candidates confuse the file-renaming and note-creation behavior with a logic bomb or virus, but the core differentiator is the extortion demand and encryption-based access loss, which is unique to ransomware.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ransomware
Ransomware is the correct answer because it specifically encrypts files and demands payment for decryption. The symptoms—documents being renamed, ransom notes appearing, and users losing access to their files—are classic indicators of ransomware activity, which typically uses strong encryption algorithms like AES or RSA to lock files.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Spyware
Why it's wrong here
Spyware is designed to covertly monitor user activity and gather sensitive information, such as credentials or browsing habits, then transmit that data to an external attacker. While some spyware can modify system files to persist or hide, it lacks the file-encryption payload and extortion-based business model that cause whole shared document repositories to suddenly become inaccessible with payment demands.
- ✓
Ransomware
Why this is correct
Ransomware is a type of extortion-based malware that encrypts files using a strong cryptographic algorithm, then presents a ransom note demanding payment—typically in cryptocurrency—for the decryption key. The rapid renaming of documents (often to a .encrypted or attacker-specific extension) and the appearance of ransom notes on a file server are hallmark indicators of a ransomware infection, especially when legitimate users can no longer open their shared files.
- ✗
Rootkit
Why it's wrong here
A rootkit is a stealthy malware category designed to conceal its presence and the presence of other malicious code by subverting operating system APIs, kernel modules, or boot processes. Although a rootkit might be used to maintain persistence on a compromised server, it does not by itself enumerate and rename user documents or display ransom demands; those actions require a payload like ransomware, making a rootkit an unlikely primary explanation for the observed symptoms.
- ✗
Worm
Why it's wrong here
A worm is a self-replicating malware that spreads autonomously across networks by exploiting vulnerabilities or using weak credentials, often consuming bandwidth or dropping additional payloads. While some ransomware strains use worm-like propagation to move laterally, a pure worm's core behavior is replication and distribution, not the deliberate renaming and encryption of every document on a file server with an immediate monetary ransom demand.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Malware Types and Characteristics
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
Key term
RSA
RSA is a cryptographic algorithm that uses a pair of keys—a public key and a private key—to secure data in transit and verify identities.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.