A file server suddenly shows renamed files with a new extension, users see a ransom note demanding cryptocurrency, and shadow copies are deleted from the host. Which malware family is the best match?

Trojan, because the attack requires a disguised program to install itself.

A trojan is malware disguised as legitimate software, but the dominant symptom here is encrypted data and a ransom demand, which points to ransomware.

Spyware, because the attacker is likely trying to monitor file activity.

Spyware focuses on covert monitoring and data collection. It does not typically encrypt files or demand payment for restoration.

Logic bomb, because the malware likely triggered after a specific condition was met.

A logic bomb is triggered by a condition or event, such as a date or user action. The visible effects here are encryption and extortion, not a timed trigger.

What does this SY0-701 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Ransomware, because the attacker is encrypting data and demanding payment to restore access. — This is a classic ransomware pattern. Renamed or encrypted files, a ransom note, and deleted shadow copies together indicate that the attacker wants to prevent easy recovery and force payment. In practice, responders should isolate affected systems, preserve evidence, and restore from offline backups only after containment and eradication steps are complete. Why others are wrong: A trojan is about disguise, not necessarily encryption and extortion. Spyware is designed for stealthy observation rather than locking data. A logic bomb triggers on a condition, but the observed outcomes here are much more consistent with ransomware behavior and recovery suppression.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.