MCQs

Disclaimer:

Educational Use Only:

The website links provided are to be used strictly for educational and knowledge-gaining purposes only.

No Misuse:

Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.

Respect for Websites and Businesses:

Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.

Acknowledge Value of Knowledge:

Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.

No Endorsement:

The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.

User Responsibility:

By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.

1. Ransomware is best described as which type of malware?
   a. Spyware
   b. Adware
   c. Malware that holds data hostage for payment
   d. Worm
   Answer: cfortinet+1​
2. The primary goal of ransomware is to:
   a. Delete files permanently
   b. Steal hardware components
   c. Restrict access to systems until a ransom is paid
   d. Install antivirus software
   Answer: ccrowdstrike+1​
3. Which of these is the most common initial vector for ransomware attacks?
   a. Phishing emails
   b. Cloud synchronization issues
   c. Weak passwords
   d. DNS misconfiguration
   Answer: aproofpoint+1​
4. The process of locking a user out of their operating system is typical of:
   a. Scareware
   b. Crypto ransomware
   c. Locker ransomware
   d. Adware
   Answer: cpaloaltonetworks+1​
5. Crypto ransomware primarily targets:
   a. Application settings
   b. File encryption on systems
   c. DNS records
   d. Browser caches
   Answer: bsentinelone+1​
6. Ransomware demands are most often paid using:
   a. Credit card
   b. Cash deposits
   c. Cryptocurrency
   d. Gift cards
   Answer: cmarshmclennan+1​
7. Bitcoin accounts for approximately what percentage of ransomware payments?
   a. 60%
   b. 75%
   c. 90%
   d. 98%
   Answer: dmarshmclennan​
8. Ransomware that threatens to leak sensitive data publicly is called:
   a. Scareware
   b. Locker ransomware
   c. Leakware or Doxware
   d. Spyware
   Answer: cpaloaltonetworks​
9. Ransomware distributed as a rented service is known as:
   a. SaaS
   b. Ransomware-as-a-Service (RaaS)
   c. DDoS-for-hire
   d. Malware-as-a-Format
   Answer: bpaloaltonetworks​
10. Ransomware encryption methods often use:
    a. AES or RSA
    b. MD5
    c. Blowfish only
    d. DES exclusively
    Answer: alepide​
11. Symmetric encryption in ransomware relies on:
    a. Public and private key pairs
    b. One shared secret key
    c. Hash-based algorithms only
    d. Blockchain-based encryption
    Answer: blepide​
12. Server asymmetric encryption stores the private key:
    a. On the client machine
    b. On the attacker’s remote server
    c. Inside antivirus systems
    d. In open text files
    Answer: blepide​
13. The three core stages of a ransomware attack are:
    a. Attack, decryption, exit
    b. Infection, encryption, ransom demand
    c. Hijack, backup, removal
    d. Social engineering, logging, forensics
    Answer: bcheckpoint​
14. A notable ransomware example exploiting the MOVEit zero-day vulnerability was:
    a. Ryuk
    b. Clop
    c. REvil
    d. Petya
    Answer: bsentinelone​
15. Akira ransomware became known for using which file extension?
    a. .akira
    b. .exe
    c. .docx
    d. .lock
    Answer: asentinelone​
16. The Vice Society ransomware group is known for targeting:
    a. Hospitals
    b. Universities and education sectors
    c. Banks
    d. Retail stores
    Answer: bsentinelone​
17. Ransomware groups often use “double extortion,” which means:
    a. Encrypt files twice
    b. Encrypt and also threaten data leaks
    c. Run two versions simultaneously
    d. Use two encryption algorithms
    Answer: bproofpoint+1​
18. The best first step after detecting ransomware activity is to:
    a. Pay the ransom immediately
    b. Shut down affected systems
    c. Contact the hacker
    d. Delete encrypted files
    Answer: bsophos​
19. Routine offline backups can help mitigate ransomware by:
    a. Preventing malware installation
    b. Allowing system restoration
    c. Disabling network access
    d. Encrypting systems
    Answer: bsecurityscorecard+1​
20. The encryption process in ransomware replaces original files with:
    a. Copies of plaintext
    b. Encrypted versions
    c. Deleted folders
    d. Backed-up data
    Answer: bcheckpoint​
21. The use of phishing as a ransomware vector relies mainly on:
    a. Manipulating user trust
    b. Weak random keys
    c. Cloud encryption
    d. Hardware faults
    Answer: aproofpoint+1​
22. Ransom notes typically include:
    a. Antivirus installation instructions
    b. Cryptocurrency payment instructions
    c. File restoration logs
    d. Hardware repair requests
    Answer: bcheckpoint​
23. Ransomware detection using AI looks for:
    a. Known virus names
    b. Behavioral anomalies
    c. Browser extensions
    d. Software version mismatches
    Answer: bmanageengine+1​
24. Setting up decoy files for identification is called:
    a. Spoof detection
    b. Deception-based detection
    c. Signature validation
    d. File mapping
    Answer: bmanageengine​
25. Signature-based ransomware detection fails when:
    a. Malware changes known patterns
    b. Antivirus updates automatically
    c. Systems are patched
    d. Files are backed up
    Answer: ablackfog​
26. Machine learning detection methods monitor:
    a. Known threat signatures
    b. Normal network behavior
    c. Registry keys only
    d. Hardware drivers
    Answer: bblackfog​
27. The first step in ransomware incident response is:
    a. Preparation
    b. Payment
    c. Decryption
    d. Media disclosure
    Answer: asisainfosec+1​
28. The containment phase of incident response involves:
    a. Restoring backups
    b. Isolating infected systems
    c. Notifying users globally
    d. Updating antivirus signatures
    Answer: bcynet+1​
29. One of the most effective employee defenses against ransomware is:
    a. Security awareness training
    b. Credential reuse
    c. File sharing policies
    d. Disabling firewalls
    Answer: asophos​
30. Principle of least privilege reduces ransomware risk by:
    a. Limiting user permissions
    b. Increasing admin access
    c. Encrypting drives
    d. Hiding files
    Answer: asisainfosec+1​
31. Double extortion is followed by:
    a. Encryption only
    b. Threatening public release of stolen data
    c. Deleting system files
    d. Replacing ransomware software
    Answer: bproofpoint+1​
32. Behavior-based detection tools look for:
    a. Rapid encryption activity
    b. Anti-virus updates
    c. User interface changes
    d. Network card resets
    Answer: amanageengine+1​
33. Malvertising in ransomware context refers to:
    a. Genuine online promotions
    b. Using compromised advertisements for malware delivery
    c. Safe data sharing
    d. Antivirus web banners
    Answer: bproofpoint​
34. RDP exploitation by ransomware attackers allows:
    a. Direct remote access to systems
    b. Hardware-level attacks
    c. Secure login
    d. Encrypted backups
    Answer: acheckpoint+1​
35. The WannaCry ransomware exploited which vulnerability?
    a. EternalBlue
    b. Spectre
    c. Heartbleed
    d. Log4Shell
    Answer: acheckpoint​
36. Scareware differs from ransomware by:
    a. Displaying fake warnings rather than encrypting files
    b. Encrypting data more thoroughly
    c. Using hardware encryption
    d. Deleting file systems
    Answer: apaloaltonetworks​
37. RaaS has contributed to:
    a. Decrease in attacks
    b. Simplified ransomware creation for affiliates
    c. Harder encryption algorithms
    d. Faster data recovery
    Answer: bpaloaltonetworks​
38. A ransomware decryptor tool is used for:
    a. Restoring files using authorized encryption keys
    b. Blocking Internet traffic
    c. Overwriting system logs
    d. Detecting system anomalies
    Answer: acommvault​
39. AI-powered ransomware tools improve detection by:
    a. Using static file analysis
    b. Learning from evolving threat patterns
    c. Storing ransom payments
    d. Deleting infected files automatically
    Answer: bmanageengine​
40. The impact of ransomware extends beyond financial loss by causing:
    a. Operational downtime and reputational damage
    b. Software updates
    c. Recruitment challenges
    d. Licensing issues
    Answer: asisainfosec​
41. Immutable storage systems protect backups from:
    a. Ransomware encryption
    b. Disk fragmentation
    c. User deletions
    d. Network overload
    Answer: asisainfosec​
42. Doxware targets victims by exploiting their fear of:
    a. Data loss
    b. Public embarrassment or legal exposure
    c. File redundancy
    d. Equipment damage
    Answer: bpaloaltonetworks​
43. The “infection vector” in ransomware refers to:
    a. How attackers gain initial access
    b. The ransom payment method
    c. The decryption key route
    d. The backup schedule
    Answer: acheckpoint​
44. The most effective network-level defense against ransomware is:
    a. Layered security and zero-trust architecture
    b. Allowing all inbound connections
    c. Centralized admin control only
    d. Software virtualization
    Answer: aproofpoint​
45. Outdated software increases ransomware risk because:
    a. It provides unpatched vulnerabilities
    b. It has slower boot times
    c. It encrypts itself
    d. It blocks antivirus programs
    Answer: asecurityscorecard+1​
46. Ransomware “double extortion” may also involve:
    a. Exfiltrating and leaking critical data
    b. Encrypting USB drives only
    c. Multiple decryption tools
    d. Deleting OS files only
    Answer: asentinelone+1​
47. One common preventive control against ransomware is:
    a. Regular security assessments
    b. Ignoring update notifications
    c. File sharing permissions
    d. Default admin credentials
    Answer: asophos​
48. Offline ransomware protection ensures safety by:
    a. Detecting dormant ransomware when networks are offline
    b. Automatically wiping drives
    c. Uploading data to the cloud
    d. Turning off system monitoring
    Answer: amanageengine​
49. A ransom note displayed on a user’s screen signals:
    a. A completed ransomware encryption phase
    b. A fake software update
    c. System maintenance
    d. File backup completion
    Answer: acheckpoint​
50. The key reason attackers prefer cryptocurrencies in ransom demands is:
    a. Traceability
    b. Anonymity and speed
    c. Compliance regulations
    d. Currency stability
    Answer: bmarshmclennan​

1. https://www.fortinet.com/resources/cyberglossary/ransomware
2. https://www.proofpoint.com/us/threat-reference/ransomware
3. https://www.crowdstrike.com/en-us/cybersecurity-101/ransomware/
4. https://www.checkpoint.com/cyber-hub/threat-prevention/ransomware/
5. https://www.paloaltonetworks.com/cyberpedia/what-are-the-most-common-types-of-ransomware
6. https://www.sentinelone.com/cybersecurity-101/cybersecurity/types-of-ransomware/
7. https://www.marshmclennan.com/web-assets/insights/publications/2020/november/ransomware-cryptocurrency.pdf
8. https://www.lepide.com/blog/common-ransomware-encryption-techniques/
9. https://www.sentinelone.com/cybersecurity-101/cybersecurity/ransomware-examples/
10. https://www.sophos.com/en-us/cybersecurity-explained/ransomware-mitigation
11. https://securityscorecard.com/blog/steps-to-mitigate-ransomware-attacks/
12. https://www.manageengine.com/ransomware-protection/ransomware-detection.html
13. https://www.blackfog.com/ransomware-detection-effective-strategies/
14. https://www.sisainfosec.com/blogs/incident-response-for-ransomware/
15. https://www.cynet.com/incident-response-services/incident-response-for-ransomware-step-by-step/
16. https://www.commvault.com/explore/ransomware-decryption
17. https://www.cybereason.com/fundamentals/what-is-ransomware
18. https://www.ibm.com/think/topics/ransomware
19. https://securityscorecard.com/blog/10-examples-of-recent-and-impactful-ransomware-attacks/
20. https://sepiocyber.com/blog/ransomware-payments/