Threats, Vulnerabilities, and Mitigations →easyMultiple ChoiceObjective-mapped

SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Exhibit

Host activity log
11:22:08  Command executed: vssadmin delete shadows /all /quiet
11:22:15  Files in Finance share renamed with extension .enc
11:22:21  Ransom note created: READ_ME_NOW.txt
11:22:28  Multiple user documents no longer open correctly

Based on the exhibit, what type of malware is most likely present?

⚠ Common exam trap

The trap here is that candidates see 'command-line utility' and think rootkit, but vssadmin deletion is a hallmark of ransomware, not a rootkit's stealth or persistence mechanism.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Ransomware, because the files are being renamed and recovery copies are being deleted.

The exhibit shows files being renamed with a new extension and recovery copies (shadow copies) being deleted via vssadmin.exe. This is a classic ransomware behavior: encrypting user files and removing Volume Shadow Copy backups to prevent recovery without the attacker's key. Ransomware specifically targets document files and system restore points to maximize extortion leverage.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Ransomware, because the files are being renamed and recovery copies are being deleted.
Why this is correct
The combination of shadow copy deletion, mass file renaming, and a ransom note is a strong match for ransomware. The attacker is attempting to prevent recovery while demanding payment or coercing the victim, which is exactly the pattern shown in the exhibit.
✗
Adware, because documents are no longer opening correctly.
Why it's wrong here
Adware is primarily a nuisance-ware designed to force advertising content onto a user, typically via pop-ups, browser redirects, or injected banners. It does not possess the mechanisms to rename files in bulk, alter document headers, or delete Volume Shadow Copies to prevent recovery. The exhibit's destructive actions—mass renaming and restoration-copy removal—are hallmarks of file-encrypting or file-locking malware, not adware, which lacks both the intent and the system-level privileges to carry out such coordinated sabotage.
✗
Rootkit, because the system is using a command-line utility.
Why it's wrong here
A rootkit is engineered for stealth and persistence, actively hiding its own processes, files, registry keys, and network connections from the operating system and security tools. The mere invocation of a command-line utility like cmd.exe or vssadmin does not indicate a rootkit; rootkits typically remain invisible to the user's normal view and do not produce observable file-renaming events or ransom notes. If a rootkit were present, the exhibit would show concealment—such as masked processes or altered system calls—not blatant file destruction and extortion, which actually draw attention to the infection.
✗
Spyware, because the attacker wants to read user documents.
Why it's wrong here
Spyware is designed to covertly collect sensitive information—keystrokes, credentials, browsing habits, or document contents—and exfiltrate it to a remote attacker without altering the victim's data. If the goal were to read user documents, the malware would open, copy, and transmit those files silently, not rename them or delete system recovery snapshots. The removal of shadow copies and the renaming of files are overt denial-of-access actions inconsistent with espionage; they indicate a monetization strategy (ransomware) rather than covert surveillance.

Go deeper

SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question