The answer is ransomware, as the exhibit’s combination of encrypted files with a '.locked' extension and the deliberate removal of Volume Shadow Copy and System Restore points are textbook indicators of this malware type. Ransomware operates by encrypting user data to extort a ransom, and it systematically deletes backup recovery options—like shadow copies—to ensure victims cannot restore files without the attacker’s decryption key. On the Security+ SY0-701 exam, this scenario tests your ability to distinguish ransomware from other malware, such as a worm or Trojan, which may encrypt files but rarely target backup deletion as a primary tactic. A common trap is confusing ransomware with a logic bomb, but the key differentiator is the explicit demand for payment and the intentional removal of recovery paths. Memory tip: “Encryption plus backup removal equals ransomware”—if both file encryption and shadow copy deletion are present, always suspect ransomware first.
SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
This SY0-701 practice question tests your understanding of threats, vulnerabilities, and mitigations. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
File server FS-02:
C:\Shared\Finance\Q4\APR_invoice.xlsx -> APR_invoice.xlsx.locked
C:\Shared\Finance\Q4\Budget2026.docx -> Budget2026.docx.locked
C:\Shared\Finance\Q4\README_RECOVER.txt created in every directory
Command history from the server console:
vssadmin delete shadows /all /quiet
wmic shadowcopy delete
Users report they can see filenames but cannot open the files.
Based on the exhibit, which malware type is most likely involved?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
File server FS-02:
C:\Shared\Finance\Q4\APR_invoice.xlsx -> APR_invoice.xlsx.locked
C:\Shared\Finance\Q4\Budget2026.docx -> Budget2026.docx.locked
C:\Shared\Finance\Q4\README_RECOVER.txt created in every directory
Command history from the server console:
vssadmin delete shadows /all /quiet
wmic shadowcopy delete
Users report they can see filenames but cannot open the files.
A
Trojan, because the malware was likely disguised as a legitimate file.
Why wrong: A trojan is malicious software disguised as something useful or normal. The exhibit does not show a disguised installer or a fake utility; it shows file encryption, ransom notes, and shadow copy deletion. Those are hallmark behaviors of an encryption-based extortion event, not simply a disguised payload.
B
Spyware, because the attacker is trying to monitor user activity quietly.
Why wrong: Spyware focuses on covert observation, such as capturing keystrokes, browsing habits, or credentials. Here, the files are renamed and made inaccessible, and recovery features were deliberately deleted. That behavior is destructive and extortion-oriented, which is not typical of spyware.
C
Ransomware, because files were encrypted and recovery options were intentionally removed.
This is ransomware. The file extensions changed, a ransom note was dropped into folders, and Volume Shadow Copy data was deleted to hinder recovery. Those are classic signs that the attacker intends to deny access to data and pressure the victim into payment. The visible symptom is loss of file availability, not stealthy monitoring or simple corruption.
D
Rootkit, because the attacker is hiding from the operating system.
Why wrong: Rootkits are designed to conceal malicious presence, often by modifying system components or hiding processes and files. This exhibit shows overt damage and extortion, not stealth. The renamed documents and recovery-note files are much more characteristic of ransomware than of a rootkit.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ransomware, because files were encrypted and recovery options were intentionally removed.
The exhibit shows that files have been encrypted with a '.locked' extension and that recovery options like System Restore and Volume Shadow Copy have been removed or disabled. This is a classic indicator of ransomware, which encrypts user data and then demands payment for decryption, often deleting backup files to prevent recovery without the attacker's key.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Trojan, because the malware was likely disguised as a legitimate file.
Why it's wrong here
A trojan is malicious software disguised as something useful or normal. The exhibit does not show a disguised installer or a fake utility; it shows file encryption, ransom notes, and shadow copy deletion. Those are hallmark behaviors of an encryption-based extortion event, not simply a disguised payload.
✗
Spyware, because the attacker is trying to monitor user activity quietly.
Why it's wrong here
Spyware focuses on covert observation, such as capturing keystrokes, browsing habits, or credentials. Here, the files are renamed and made inaccessible, and recovery features were deliberately deleted. That behavior is destructive and extortion-oriented, which is not typical of spyware.
✓
Ransomware, because files were encrypted and recovery options were intentionally removed.
Why this is correct
This is ransomware. The file extensions changed, a ransom note was dropped into folders, and Volume Shadow Copy data was deleted to hinder recovery. Those are classic signs that the attacker intends to deny access to data and pressure the victim into payment. The visible symptom is loss of file availability, not stealthy monitoring or simple corruption.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Rootkit, because the attacker is hiding from the operating system.
Why it's wrong here
Rootkits are designed to conceal malicious presence, often by modifying system components or hiding processes and files. This exhibit shows overt damage and extortion, not stealth. The renamed documents and recovery-note files are much more characteristic of ransomware than of a rootkit.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may confuse the removal of recovery options with a rootkit's stealth techniques, but ransomware's goal is to deny access to data (not hide), and the overt encryption and backup deletion are the key differentiators.
Trap categories for this question
Command / output trap
A trojan is malicious software disguised as something useful or normal. The exhibit does not show a disguised installer or a fake utility; it shows file encryption, ransom notes, and shadow copy deletion. Those are hallmark behaviors of an encryption-based extortion event, not simply a disguised payload.
Detailed technical explanation
How to think about this question
Ransomware often uses strong symmetric encryption (e.g., AES-256) to encrypt files quickly, then may encrypt the symmetric key with an asymmetric public key (e.g., RSA-2048) so only the attacker can decrypt. It commonly deletes Volume Shadow Copies via `vssadmin.exe delete shadows /all` and disables System Restore to force victims to pay the ransom, as seen in real-world variants like LockBit or Ryuk.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A developer is choosing between AES-256 (symmetric) and RSA-2048 (asymmetric) for encrypting a large file that will be sent to a partner. Symmetric encryption is fast but requires key exchange; asymmetric is slower but solves the key distribution problem. A hybrid approach — encrypt the file with AES, encrypt the AES key with RSA — is standard. Questions like this test whether you understand when each approach applies.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SY0-701 question in full detail.
Threats, Vulnerabilities, and Mitigations — This question tests Threats, Vulnerabilities, and Mitigations — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Ransomware, because files were encrypted and recovery options were intentionally removed. — The exhibit shows that files have been encrypted with a '.locked' extension and that recovery options like System Restore and Volume Shadow Copy have been removed or disabled. This is a classic indicator of ransomware, which encrypts user data and then demands payment for decryption, often deleting backup files to prevent recovery without the attacker's key.
What should I do if I get this SY0-701 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, what type of malware is most likely present?
easy
✓ A.Ransomware, because the files are being renamed and recovery copies are being deleted.
B.Adware, because documents are no longer opening correctly.
C.Rootkit, because the system is using a command-line utility.
D.Spyware, because the attacker wants to read user documents.
Why A: The exhibit shows files being renamed with a new extension and recovery copies (shadow copies) being deleted via vssadmin.exe. This is a classic ransomware behavior: encrypting user files and removing Volume Shadow Copy backups to prevent recovery without the attacker's key. Ransomware specifically targets document files and system restore points to maximize extortion leverage.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.