Question 202 of 1,013
SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
Exhibit
File server FS-02: C:\Shared\Finance\Q4\APR_invoice.xlsx -> APR_invoice.xlsx.locked C:\Shared\Finance\Q4\Budget2026.docx -> Budget2026.docx.locked C:\Shared\Finance\Q4\README_RECOVER.txt created in every directory Command history from the server console: vssadmin delete shadows /all /quiet wmic shadowcopy delete Users report they can see filenames but cannot open the files.
Based on the exhibit, which malware type is most likely involved?
⚠ Common exam trap
A common mix-up: candidates confuse the removal of recovery options with a rootkit's stealth techniques, but ransomware's goal is to deny access to data (not hide), and the overt encryption and backup deletion are the key differentiators.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ransomware, because files were encrypted and recovery options were intentionally removed.
The exhibit shows that files have been encrypted with a '.locked' extension and that recovery options like System Restore and Volume Shadow Copy have been removed or disabled. This is a classic indicator of ransomware, which encrypts user data and then demands payment for decryption, often deleting backup files to prevent recovery without the attacker's key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Trojan, because the malware was likely disguised as a legitimate file.
Why it's wrong here
A trojan is malicious software disguised as something useful or normal. The exhibit does not show a disguised installer or a fake utility; it shows file encryption, ransom notes, and shadow copy deletion. Those are hallmark behaviors of an encryption-based extortion event, not simply a disguised payload.
- ✗
Spyware, because the attacker is trying to monitor user activity quietly.
Why it's wrong here
Spyware focuses on covert observation, such as capturing keystrokes, browsing habits, or credentials. Here, the files are renamed and made inaccessible, and recovery features were deliberately deleted. That behavior is destructive and extortion-oriented, which is not typical of spyware.
- ✓
Ransomware, because files were encrypted and recovery options were intentionally removed.
Why this is correct
This is ransomware. The file extensions changed, a ransom note was dropped into folders, and Volume Shadow Copy data was deleted to hinder recovery. Those are classic signs that the attacker intends to deny access to data and pressure the victim into payment. The visible symptom is loss of file availability, not stealthy monitoring or simple corruption.
- ✗
Rootkit, because the attacker is hiding from the operating system.
Why it's wrong here
Rootkits are designed to conceal malicious presence, often by modifying system components or hiding processes and files. This exhibit shows overt damage and extortion, not stealth. The renamed documents and recovery-note files are much more characteristic of ransomware than of a rootkit.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, what type of malware is most likely present?
easy- ✓ A.Ransomware, because the files are being renamed and recovery copies are being deleted.
- B.Adware, because documents are no longer opening correctly.
- C.Rootkit, because the system is using a command-line utility.
- D.Spyware, because the attacker wants to read user documents.
Why A: The exhibit shows files being renamed with a new extension and recovery copies (shadow copies) being deleted via vssadmin.exe. This is a classic ransomware behavior: encrypting user files and removing Volume Shadow Copy backups to prevent recovery without the attacker's key. Ransomware specifically targets document files and system restore points to maximize extortion leverage.
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.