Question 1
A workstation suddenly shows fake “infection” pop-ups urging payment, but no files are encrypted. What’s the most likely threat?
Crypto ransomware
Scareware
Worm
Rootkit
Question 2
A threat spreads rapidly across a flat network without users opening files. Which behavior fits best?
Worm
Virus
Trojan
Adware
Question 3
You find an app that looked useful, but once installed it opened a backdoor and exfiltrated browser creds. Classification?
Virus
Trojan
Worm
Keylogger
Question 4
Which control most directly reduces blast radius when ransomware lands on a single endpoint?
MFA on VPN
Full-disk encryption
Network segmentation with least privilege
Email banner warnings
Question 5
An org pays a ransom and receives a decryptor. What is a realistic risk that remains?
Encryption keys won’t exist on the attacker side
Backups become read-only
Antivirus signatures become invalid
Data exfiltrated earlier may be extorted/leaked (“double extortion”)
Question 6
Which sign is a weak indicator of active ransomware compared to others?
Mass file extensions changing to random suffixes
Ransom note in multiple directories
AV/EDR alert spikes + unusual encryption processes
Single popup ad in a browser session
Question 7
A user asks how to “clean a suspicious program” they installed themselves. Which workflow is most appropriate?
Delete the suspected EXE and clear recycle bin
Run Disk Cleanup and defrag
Update definitions → full scan → quarantine → remove → reboot → re-scan
Disable firewall temporarily to let tools download faster
There are 7 questions to complete.